[SSSD] Problems configuring sssd for ssl/ldaps no tls

sssd help sssdhelp at gmail.com
Thu Feb 10 23:08:08 UTC 2011


Hey Stephen, Just a little more information incase this helps in
troubleshooting. After talking to my group i was reminded that the reason we
cant use TLS is because we are using hardware loadbalancers to handle the
ssl offload and proxy between multiple ldap servers.

Is there any reason you can think of that using a loadbalancer in this case
would cause an initial ldaps connection to fail?

I noticed in the logs that even though i explicitly request sssd to not use
start_tls, it still runs:

"Executing START_TLS"

is there any way to stop this behavior?

On Thu, Feb 10, 2011 at 3:41 PM, sssd help <sssdhelp at gmail.com> wrote:

> I can also confirm that i am using a CA cert bundle provided by our CA.
>
>
> On Thu, Feb 10, 2011 at 3:28 PM, Stephen Gallagher <sgallagh at redhat.com>wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 02/10/2011 03:25 PM, sssd help wrote:
>> > We are using Sun DSEE 6. Would errors regarding certificate failures be
>> in
>> > the same /var/log/sssd/sssd_default.log or one of the others.
>> >
>>
>> It should still be in /var/log/sssd/sssd_default.log
>>
>> I'm at something of a loss on the ldap_result issue though. I don't have
>> a clue why it would behave any differently on LDAPS as opposed to
>> LDAP+TLS.
>>
>> - --
>> Stephen Gallagher
>> RHCE 804006346421761
>>
>> Delivering value year after year.
>> Red Hat ranks #1 in value among software vendors.
>> http://www.redhat.com/promo/vendor/
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG v1.4.11 (GNU/Linux)
>> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
>>
>> iEYEARECAAYFAk1USlIACgkQeiVVYja6o6P7iACfQtLFQjYCxp7hgSbStc3VAlTy
>> kp8Aniyog28zrjhFxul6WFKeEFs0KsaT
>> =XXMe
>> -----END PGP SIGNATURE-----
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/sssd-devel
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110210/80bc8a4b/attachment.html>


More information about the sssd-devel mailing list