[SSSD] [PATCH] LDAP: Set sdap handle as explicitly connected in LDAP auth

Jakub Hrozek jhrozek at redhat.com
Wed Apr 8 13:19:52 UTC 2015


On Wed, Apr 08, 2015 at 03:03:31PM +0200, Pavel Březina wrote:
> On 04/07/2015 01:15 PM, Jakub Hrozek wrote:
> >Hi,
> >
> >to reproduce, set up an ldaps:// server (TLS won't reproduce the bug)
> >and configure the client as:
> >
> >[domain/default]
> >id_provider = proxy
> >proxy_lib_name = files
> >auth_provider = ldap
> >ldap_uri = ldaps://openldap.example.com
> >ldap_user_search_base = ou=People,dc=example,dc=com
> >ldap_group_search_base = ou=People,dc=example,dc=com
> >ldap_search_base = dc=example,dc=com
> >ldap_tls_reqcert = demand
> >ldap_tls_cacertdir = /etc/openldap/cacerts
> >ldap_schema = rfc2307bis
> >ldap_user_object_class = inetOrgPerson
> >debug_level = 9
> >timeout = 30000
> >
> >Before the patch you'll get an error saying you're not connected.
> >
> >I think the proper solution would be to change the LDAP provider to
> >mark the connection as connected automatically, but there is logic in
> >sdap_async_connection that should be changed as well and the code around
> >whether to use TLS or not is a bit complex. Also, I would prefer to make
> >sdap_handle opaque outside the low-level code.
> 
> Ack.

Thank you for review, so far pushed to master:
450c2b78ff0bd5044c4c73f32ca8459b211dd446

We'll triage the ticket later.



More information about the sssd-devel mailing list