[SSSD] [PATCH] LDAP: Set sdap handle as explicitly connected in LDAP auth

Pavel Březina pbrezina at redhat.com
Wed Apr 8 13:03:31 UTC 2015


On 04/07/2015 01:15 PM, Jakub Hrozek wrote:
> Hi,
>
> to reproduce, set up an ldaps:// server (TLS won't reproduce the bug)
> and configure the client as:
>
> [domain/default]
> id_provider = proxy
> proxy_lib_name = files
> auth_provider = ldap
> ldap_uri = ldaps://openldap.example.com
> ldap_user_search_base = ou=People,dc=example,dc=com
> ldap_group_search_base = ou=People,dc=example,dc=com
> ldap_search_base = dc=example,dc=com
> ldap_tls_reqcert = demand
> ldap_tls_cacertdir = /etc/openldap/cacerts
> ldap_schema = rfc2307bis
> ldap_user_object_class = inetOrgPerson
> debug_level = 9
> timeout = 30000
>
> Before the patch you'll get an error saying you're not connected.
>
> I think the proper solution would be to change the LDAP provider to
> mark the connection as connected automatically, but there is logic in
> sdap_async_connection that should be changed as well and the code around
> whether to use TLS or not is a bit complex. Also, I would prefer to make
> sdap_handle opaque outside the low-level code.

Ack.




More information about the sssd-devel mailing list