[SSSD] [PATCH] Add ldap_sasl_minssf option

Jan Zelený jzeleny at redhat.com
Wed Nov 30 12:20:03 UTC 2011


> On Tue, Nov 22, 2011 at 12:45:14PM +0100, Jan Zelený wrote:
> > https://fedorahosted.org/sssd/ticket/1075
> > 
> > The only thing is that I'm not sure if 72 is the right default minssf
> > value for IPA provider, as default IPA installation works with 56 as the
> > highest possible value for me. In default SSSD installation, this means
> > that communication with IPA server will be rejected with no information
> > about the reason being min SSF. I think this will be very confusing to
> > SSSD users.
> > 
> > Can anyone give me a hint how to proceed? Lower the default value in SSSD
> > or do the change in IPA?
> > 
> > Thanks
> > Jan
> 
> The patch itself looks good to me.
> 
> I don't know what's causing the problem, though. I think that the SSF
> requirement is set in nsslapd-minssf attribute in cn=config on the server
> side. My (quite recent) IPA server install has the option set to 0,
> which means "no restrictions".
> 
> Rob, is there any other place on the server that sets the SSF values?

Just to clarify, I tested the minssf=56 as working by using ldapsearch, not 
just SSSD, so the issue is most likely not on our side.

Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111130/0ba421d5/attachment.sig>


More information about the sssd-devel mailing list