[SSSD] [PATCH] Do not attempt to use START_TLS on SSL connections

Sumit Bose sbose at redhat.com
Wed Feb 16 13:39:46 UTC 2011


On Wed, Feb 16, 2011 at 07:49:18AM -0500, Stephen Gallagher wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On 02/16/2011 07:18 AM, Sumit Bose wrote:
> > On Tue, Feb 15, 2011 at 07:43:37AM -0500, Stephen Gallagher wrote:
> > On 02/15/2011 07:21 AM, Sumit Bose wrote:
> >>>> On Mon, Feb 14, 2011 at 04:10:51PM -0500, Stephen Gallagher wrote:
> >>>>
> >>>> Good catch. New patches for 1.5.x/HEAD and 1.2.x attached.
> >>>>
> >>>>
> >>>>> Thanks the patch is working as expected, but I have a question about
> >>>>> ldapi. It is possilbe to configure a LDAP server to require e.g. TLS
> >>>>> even over ldapi, see e.g  the discussion in
> >>>>> http://www.openldap.org/lists/openldap-technical/200906/msg00098.html.
> >>>>> Do we consider this as a configuration error and say use ldaps is ldapi
> >>>>> requires TLS or shall we allow TLS over ldapi ?
> > 
> > With these open questions, I've opted to drop the reference to LDAPI in
> > the ldap_uri_is_secure() function for now until we opt to address
> > https://fedorahosted.org/sssd/ticket/609
> > 
> > New patch attached.
> > 
> >> You have attached only one patch, but I assume you've edited the other
> >> one accordingly.
> > 
> >> ACK
> 
> Whoops. For the record, the patch for 1.2.x is now attached.
> 

ACK to this one as well.

bye,
Sumit

> - -- 
> Stephen Gallagher
> RHCE 804006346421761
> 
> Delivering value year after year.
> Red Hat ranks #1 in value among software vendors.
> http://www.redhat.com/promo/vendor/
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk1bx84ACgkQeiVVYja6o6N3ugCgg1P1QMhJKBG2dNPJrgF1fv6T
> H10Anisixl/eQMk3jpQ0oi8VbfvaE4nF
> =ycXV
> -----END PGP SIGNATURE-----



More information about the sssd-devel mailing list