[SSSD] LDAP Service Discovery Problem
John Hodrien
J.H.Hodrien at leeds.ac.uk
Fri May 10 16:13:29 UTC 2013
On Fri, 10 May 2013, Joshua Riffle wrote:
> As pointed out to me in a couple of the other responses TLS and not SSL is
> probably the better way to go which is surprising to me but admittedly I am
> new to the LDAP security world and that will give me something to research
> more deeply. Does SSSD cater more to the TLS + LDAP combination?
I think this is just a general truism. You end up with a single service on a
single port that allows connections at an appropriate security level as
defined in rules server side. TLS is the successor to SSL.
> My hope was to see how far I could get with a fairly secure Kerberos + LDAP
> combination that could (mostly) automatically be pushed to the clients
> (SSSD) with as little configuration as possible. Initially LDAPS seemed to
> make sense and SRV records for DNS Discovery also seemed like a decent
> choice.
I think you're basically spot on, apart from your choice of SSL over TLS.
Service Discovery is *clearly* the way to go IMO.
Feel free to ask about anything else, minimal configuration LDAP(TLS) + krb5
is the setup I use, albeit against Active Directory.
jh
More information about the sssd-devel
mailing list