[SSSD] [PATCH] Add ldap_sasl_minssf option

Jakub Hrozek jhrozek at redhat.com
Thu Dec 1 09:35:07 UTC 2011


On Wed, Nov 30, 2011 at 01:20:03PM +0100, Jan Zelený wrote:
> > On Tue, Nov 22, 2011 at 12:45:14PM +0100, Jan Zelený wrote:
> > > https://fedorahosted.org/sssd/ticket/1075
> > > 
> > > The only thing is that I'm not sure if 72 is the right default minssf
> > > value for IPA provider, as default IPA installation works with 56 as the
> > > highest possible value for me. In default SSSD installation, this means
> > > that communication with IPA server will be rejected with no information
> > > about the reason being min SSF. I think this will be very confusing to
> > > SSSD users.
> > > 
> > > Can anyone give me a hint how to proceed? Lower the default value in SSSD
> > > or do the change in IPA?
> > > 
> > > Thanks
> > > Jan
> > 
> > The patch itself looks good to me.
> > 
> > I don't know what's causing the problem, though. I think that the SSF
> > requirement is set in nsslapd-minssf attribute in cn=config on the server
> > side. My (quite recent) IPA server install has the option set to 0,
> > which means "no restrictions".
> > 
> > Rob, is there any other place on the server that sets the SSF values?
> 
> Just to clarify, I tested the minssf=56 as working by using ldapsearch, not 
> just SSSD, so the issue is most likely not on our side.
> 
> Jan

Looking at OpenLDAP code, the SSF options can also be manipulated using
LDAP_OPT_X_SASL_SECPROPS, maybe the two are in conflict?



More information about the sssd-devel mailing list