[SSSD-users] sssd.conf, authconfig and ldap_uri
Michael Ströder
michael at stroeder.com
Wed Sep 25 18:22:57 UTC 2013
Stephen Gallagher wrote:
> On 09/25/2013 09:06 AM, Olivier wrote:
>> if I may an additionnal question : would the sssd fallback
>> mecanism work with the DNS discovery ?
>
>> Aka, if I'd configure this in the DNS :
>
>> _ldap._tcp.example.com <http://tcp.example.com>. IN SRV 10 0 389
>> ldap1.example.com <http://ldap1.example.com>.
>> _ldap._tcp.example.com <http://tcp.example.com>. IN SRV 20 0 389
>> ldap2.example.com <http://ldap2.example.com>.
>
>> will sssd fallback properly to ldap2 if ldap1 does not respond ?
>
> Yes, and in fact this is the recommended mechanism for setting up SSSD
> in your environment, since you need only to update the DNS records and
> all of your clients will have access to a new set of LDAP servers
> (i.e. if you provision additional ones and/or retire others).
Hmm, I really wonder why SRV RRs are recommended over having a single service
CNAME RR and maybe several A/AAAA RRs?
Especially I'm concerned whether the TLS hostname check is properley done in
case of TLS connections (StartTLS ext.op or LDAPS). Because a hostname check
has to be performed against *a-priori* knowledge of the client to fight
against MITM attacks with DNS spoofing.
So if you're local configuration just knows "example.com" the server cert MUST
have a subject alt name with that domain name. I doubt that LDAP clients
really check this.
Ciao, Michael.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2398 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20130925/84ef0cff/attachment-0001.p7s>
More information about the sssd-users
mailing list