[SSSD] LDAP Service Discovery Problem

Jakub Hrozek jhrozek at redhat.com
Fri May 10 08:40:03 UTC 2013


On Fri, May 10, 2013 at 09:23:33AM +0100, John Hodrien wrote:
> On Thu, 9 May 2013, Joshua Riffle wrote:
> 
> >In the case of service discovery there seems to be no way of getting LDAP to
> >be treated as LDAPS (secure) and I think this may be leading to a
> >segmentation fault in the sss_ldap library.
> 

A segmentation fault? Can you get us a backtrace or a core file, please?
Even if the functionality didn't work as expected, we should never ever
segfault.

> >_ldap._tcp              SRV  0 0 636 ldap
> 
> >ldaps (which is correct!) and instead makes it regular old ldap which is
> >bound to fail.
> 
> I think this is the point.  It's an LDAP record, so it'll get used as LDAP, so
> that entry is incorrect and should point to the plain/tls port not the LDAPS
> port.
> 

IIRC the exact same issue came up recently on #sssd on freenode. Someone
(Stephen perhaps?) suggested that if the port in the SRV entry was set to
636 we could try ldaps:// first and fall back to ldap:// instead of simply
trying ldap:// all the time.

I'm going to file this request as an RFE, but to be honest I'd consider
it a "nice-to-have-patch-welcome" feature rather than something that
would be available in the next release:
https://fedorahosted.org/sssd/ticket/1920

> >My thought was to change my SRV record from _ldap (the service name) to
> >_ldaps but then Service Discovery in SSSD doesn't find an LDAP server!
> 
> I'm not clear that there *is* an approved way to autodiscover ldaps.
> 
> >Any suggestions?
> 
> Do you have a really strong and sound reason to want SSL?
> 
> Just use GSSAPI and point it at your plain LDAP port, and peer at the
> wireshark traces to see just how non-plain the traffic is.
> 
> jh

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list