[SSSD] LDAP Service Discovery Problem

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri May 10 08:23:33 UTC 2013


On Thu, 9 May 2013, Joshua Riffle wrote:

> In the case of service discovery there seems to be no way of getting LDAP to
> be treated as LDAPS (secure) and I think this may be leading to a
> segmentation fault in the sss_ldap library.

> _ldap._tcp              SRV  0 0 636 ldap

> ldaps (which is correct!) and instead makes it regular old ldap which is
> bound to fail.

I think this is the point.  It's an LDAP record, so it'll get used as LDAP, so
that entry is incorrect and should point to the plain/tls port not the LDAPS
port.

> My thought was to change my SRV record from _ldap (the service name) to
> _ldaps but then Service Discovery in SSSD doesn't find an LDAP server!

I'm not clear that there *is* an approved way to autodiscover ldaps.

> Any suggestions?

Do you have a really strong and sound reason to want SSL?

Just use GSSAPI and point it at your plain LDAP port, and peer at the
wireshark traces to see just how non-plain the traffic is.

jh


More information about the sssd-devel mailing list