[SSSD] Problems configuring sssd for ssl/ldaps no tls

Stephen Gallagher sgallagh at redhat.com
Fri Feb 11 12:27:36 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/10/2011 06:08 PM, sssd help wrote:
> Hey Stephen, Just a little more information incase this helps in
> troubleshooting. After talking to my group i was reminded that the reason we
> cant use TLS is because we are using hardware loadbalancers to handle the
> ssl offload and proxy between multiple ldap servers.
> 
> Is there any reason you can think of that using a loadbalancer in this case
> would cause an initial ldaps connection to fail?

It's possible that a faulty SSL load balancer might be resulting in
sending back invalid data. But I'd assume you'd be seeing that in all
your clients, not just SSSD. It's worth investigating, though. It's
possible that the load balancers are adding something to the message
that SSSD is not expecting (but should be). It's hard to debug over SSL,
though.

> I noticed in the logs that even though i explicitly request sssd to not use
> start_tls, it still runs:
> 
> "Executing START_TLS"
> 
> is there any way to stop this behavior?

Are you seeing that START_TLS message when you have an ldaps:// URI
specified? That sounds like a bug, if so. (Shouldn't be happening; we
check for whether an encrypted channel is already available before we
call that function)

If you're using ldap:// as a URI, it's not possible to disable TLS for
authentication. This is because the LDAP protocol sends bind passwords
in the clear. SSSD mandates that passwords must be sent over an
encrypted channel, to protect against password sniffing.


In an earlier email, you said "When I attempt to enable ldaps by
changing the ldap uri to ldaps:// authentication no longer functions.
However, id and getent functionality remains."

Are you sure this is true? Since you have "enumerate = true", all of
your identities would have been cached when you were using ldap://, so
they may just be returning from the cache when you switch to ldaps://

Please purge the cache when switching to ldaps (rm -f
/var/lib/sss/db/cache_default.ldb) and then please retest. (I want to
know if the problem is truly exclusive to authentication)

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1VKy4ACgkQeiVVYja6o6PNtgCfTieowbjcVXaxyLPG9tPfiArQ
glkAn1opTMNLfq5TnKKWh8V6W92gM9y8
=Zd0+
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list