[SSSD] [PATCH] Allow authentication for referrals

Stephen Gallagher sgallagh at redhat.com
Wed Oct 27 13:12:46 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/26/2010 01:57 PM, Stephen Gallagher wrote:
> On 10/26/2010 12:02 PM, Sumit Bose wrote:
>> Hi,
> 
>> this patch add a rebind proc which uses the same credentials used for
>> the primary server to authenticate to the second server when doing
>> referral chasing.
> 
>> There are two important things to keep in mind:
>> - as already mentioned we use the same credentials for both connections,
>>   i.e. if TLS is used on the first connection, it will be used un the
>>   second too. If GSSAPI is use for the first server it will be used for
>>   the second server with the same realm/KDC/keytab settings. If we want
>>   different credentials and authentication schemes for different server
>>   we should address this in a separate patch.
>> - everything is synchronous, let me repeat: synchronous. From 'man
>>   ldap_set_rebind_proc': "The rebind function must use a synchronous
>>   bind method."
> 
>> I have tested this patch against an OpenLDAP server with GSSAPI and
>> simple bind with and without TLS.
> 
>> This patch should fix ticket #495.
> 
> Nothing we can do to avoid a synchronous bind here. This is the best we
> can do.
> 
> Ack.
> 

Pushed to master.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkzIJU4ACgkQeiVVYja6o6OkfQCgkTCIjdta3dIJJtMxAubEYIZ0
X9wAniTqQptvJN/vQVZrsYai8+14UUeU
=K5mw
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list