[SSSD] [PATCH] Do not attempt to use START_TLS on SSL connections

Sumit Bose sbose at redhat.com
Tue Feb 15 12:21:08 UTC 2011


On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 02/14/2011 03:31 PM, Sumit Bose wrote:
> > On Fri, Feb 11, 2011 at 02:36:30PM -0500, Stephen Gallagher wrote:
> > On 02/11/2011 01:24 PM, Stephen Gallagher wrote:
> >>>> Not all LDAP servers are capable of handling dual-encryption with
> >>>> both TLS and SSL.
> >>>>
> >>>> Fixes https://fedorahosted.org/sssd/ticket/795
> >>>>
> >>>> Patches attached for 1.5.x/HEAD and 1.2.x
> > 
> > I made a mistake with the backport to 1.2.x and it was having no effect.
> > Corrected patch attached.
> > 
> > 
> >> The patch is working as expected, but you might want to add a similar
> >> check to sdap_cli_resolve_done(). If ldap_id_use_start_tls is set there
> >> might be setups where multiple ldap:// and ldaps:// servers are defined,
> >> were an explict start TLS is only wnated for the ldap:// services.
> > 
> 
> Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
> 

Thanks the patch is working as expected, but I have a question about
ldapi. It is possilbe to configure a LDAP server to require e.g. TLS
even over ldapi, see e.g  the discussion in
http://www.openldap.org/lists/openldap-technical/200906/msg00098.html.
Do we consider this as a configuration error and say use ldaps is ldapi
requires TLS or shall we allow TLS over ldapi ?

bye,
Sumit

> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk1ZmlsACgkQeiVVYja6o6MOfACfahWgHzajAnSbf+bE2aKze2WV
> r/kAnRETX/cFGnB6hbC4CT+kSPoeGvkr
> =/mkd
> -----END PGP SIGNATURE-----



More information about the sssd-devel mailing list