[SSSD] [PATCH] Add option to disable TLS for LDAP auth

Stephen Gallagher sgallagh at redhat.com
Tue Jan 25 15:57:34 UTC 2011


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

This is going to be a controversial patch. It adds support for an option
called "ldap_auth_disable_tls_never_use_in_production" which allows SSSD
to perform LDAP simple-bind authentication without a corresponding TLS
tunnel.

Multiple users have requested (arguably demanded) this feature for
"debugging" purposes. We've resisted it for a long time, but after a
certain point, once people yell often enough, it's probably worth it to
listen.

The option added by this patch is intentionally left out of the manpage
and the SSSDConfig API, as a means to strongly discourage its use.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAk0+8u4ACgkQeiVVYja6o6M1rwCdH9Gzi66lBzItaKFtGiLZFyIN
I3cAmgKzw1fUPUR8ckZfRl8+svO8NR3F
=d0sd
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-option-to-disable-TLS-for-LDAP-auth.patch
Type: text/x-patch
Size: 4914 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110125/b66b5369/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Add-option-to-disable-TLS-for-LDAP-auth.patch.sig
Type: application/pgp-signature
Size: 72 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110125/b66b5369/attachment.sig>


More information about the sssd-devel mailing list