[SSSD] Problems configuring sssd for ssl/ldaps no tls

sssd help sssdhelp at gmail.com
Fri Feb 11 17:23:40 UTC 2011


Thank you for the taking a look Sumit.

I am testing with ldapsearch now. My first searches are returning:
ldap_start_tls: Connect error (-11)

which i guess is what we would expect since we cant do tls against our load
balancers. I will continue testing and let you know if I come up with
something different.

Brandon

On Fri, Feb 11, 2011 at 7:37 AM, Sumit Bose <sbose at redhat.com> wrote:

> On Fri, Feb 11, 2011 at 07:27:36AM -0500, Stephen Gallagher wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > On 02/10/2011 06:08 PM, sssd help wrote:
> > > Hey Stephen, Just a little more information incase this helps in
> > > troubleshooting. After talking to my group i was reminded that the
> reason we
> > > cant use TLS is because we are using hardware loadbalancers to handle
> the
> > > ssl offload and proxy between multiple ldap servers.
> > >
> > > Is there any reason you can think of that using a loadbalancer in this
> case
> > > would cause an initial ldaps connection to fail?
> >
> > It's possible that a faulty SSL load balancer might be resulting in
> > sending back invalid data. But I'd assume you'd be seeing that in all
> > your clients, not just SSSD. It's worth investigating, though. It's
> > possible that the load balancers are adding something to the message
> > that SSSD is not expecting (but should be). It's hard to debug over SSL,
> > though.
> >
> > > I noticed in the logs that even though i explicitly request sssd to not
> use
> > > start_tls, it still runs:
> > >
> > > "Executing START_TLS"
> > >
> > > is there any way to stop this behavior?
> >
> > Are you seeing that START_TLS message when you have an ldaps:// URI
> > specified? That sounds like a bug, if so. (Shouldn't be happening; we
> > check for whether an encrypted channel is already available before we
> > call that function)
>
> I've just checked, we call START_TLS on every authentication and do not
> check if TLS is already active due to ldaps. Maybe Sun DSEE does not
> like the double encryption. Can you check if
>
> ldapsearch -ZZ -H ldaps://....
>
> works with your LDAP server?
>
> bye,
> Sumit
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110211/e5e872e3/attachment.html>


More information about the sssd-devel mailing list