[SSSD] Problems configuring sssd for ssl/ldaps no tls

Sumit Bose sbose at redhat.com
Fri Feb 11 12:37:08 UTC 2011


On Fri, Feb 11, 2011 at 07:27:36AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 02/10/2011 06:08 PM, sssd help wrote:
> > Hey Stephen, Just a little more information incase this helps in
> > troubleshooting. After talking to my group i was reminded that the reason we
> > cant use TLS is because we are using hardware loadbalancers to handle the
> > ssl offload and proxy between multiple ldap servers.
> > 
> > Is there any reason you can think of that using a loadbalancer in this case
> > would cause an initial ldaps connection to fail?
> 
> It's possible that a faulty SSL load balancer might be resulting in
> sending back invalid data. But I'd assume you'd be seeing that in all
> your clients, not just SSSD. It's worth investigating, though. It's
> possible that the load balancers are adding something to the message
> that SSSD is not expecting (but should be). It's hard to debug over SSL,
> though.
> 
> > I noticed in the logs that even though i explicitly request sssd to not use
> > start_tls, it still runs:
> > 
> > "Executing START_TLS"
> > 
> > is there any way to stop this behavior?
> 
> Are you seeing that START_TLS message when you have an ldaps:// URI
> specified? That sounds like a bug, if so. (Shouldn't be happening; we
> check for whether an encrypted channel is already available before we
> call that function)

I've just checked, we call START_TLS on every authentication and do not
check if TLS is already active due to ldaps. Maybe Sun DSEE does not
like the double encryption. Can you check if

ldapsearch -ZZ -H ldaps://....

works with your LDAP server?

bye,
Sumit



More information about the sssd-devel mailing list