[SSSD] LDAP Service Discovery Problem

John Hodrien J.H.Hodrien at leeds.ac.uk
Fri May 10 16:13:29 UTC 2013


On Fri, 10 May 2013, Joshua Riffle wrote:

> As pointed out to me in a couple of the other responses TLS and not SSL is
> probably the better way to go which is surprising to me but admittedly I am
> new to the LDAP security world and that will give me something to research
> more deeply. Does SSSD cater more to the TLS + LDAP combination?

I think this is just a general truism.  You end up with a single service on a
single port that allows connections at an appropriate security level as
defined in rules server side.  TLS is the successor to SSL.

> My hope was to see how far I could get with a fairly secure Kerberos + LDAP
> combination that could (mostly) automatically be pushed to the clients
> (SSSD) with as little configuration as possible. Initially LDAPS seemed to
> make sense and SRV records for DNS Discovery also seemed like a decent
> choice.

I think you're basically spot on, apart from your choice of SSL over TLS.
Service Discovery is *clearly* the way to go IMO.

Feel free to ask about anything else, minimal configuration LDAP(TLS) + krb5
is the setup I use, albeit against Active Directory.

jh



More information about the sssd-devel mailing list