[SSSD] [PATCH] Do not attempt to use START_TLS on SSL connections

Stephen Gallagher sgallagh at redhat.com
Wed Feb 16 12:49:18 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/16/2011 07:18 AM, Sumit Bose wrote:
> On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote:
> On 02/15/2011 07:21 AM, Sumit Bose wrote:
>>>> On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
>>>>
>>>> Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
>>>>
>>>>
>>>>> Thanks the patch is working as expected, but I have a question about
>>>>> ldapi. It is possilbe to configure a LDAP server to require e.g. TLS
>>>>> even over ldapi, see e.g  the discussion in
>>>>> http://www.openldap.org/lists/openldap-technical/200906/msg00098.html.
>>>>> Do we consider this as a configuration error and say use ldaps is ldapi
>>>>> requires TLS or shall we allow TLS over ldapi ?
> 
> With these open questions, I've opted to drop the reference to LDAPI in
> the ldap_uri_is_secure() function for now until we opt to address
> https://fedorahosted.org/sssd/ticket/609
> 
> New patch attached.
> 
>> You have attached only one patch, but I assume you've edited the other
>> one accordingly.
> 
>> ACK

Whoops. For the record, the patch for 1.2.x is now attached.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk1bx84ACgkQeiVVYja6o6N3ugCgg1P1QMhJKBG2dNPJrgF1fv6T
H10Anisixl/eQMk3jpQ0oi8VbfvaE4nF
=ycXV
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections.patch
Type: text/x-patch
Size: 4905 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110216/4596dfd8/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Do-not-attempt-to-use-START_TLS-on-SSL-connections.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110216/4596dfd8/attachment.sig>


More information about the sssd-devel mailing list