[SSSD-users] sssd.conf, authconfig and ldap_uri

Michael Ströder michael at stroeder.com
Wed Sep 25 18:22:57 UTC 2013


Stephen Gallagher wrote:
> On 09/25/2013 09:06 AM, Olivier wrote:
>> if I may an additionnal question : would the sssd fallback
>> mecanism work with the DNS discovery ?
> 
>> Aka, if I'd configure this in the DNS :
> 
>> _ldap._tcp.example.com <http://tcp.example.com>.	IN	SRV	10 0 389
>> ldap1.example.com <http://ldap1.example.com>. 
>> _ldap._tcp.example.com <http://tcp.example.com>.	IN	SRV	20 0 389
>> ldap2.example.com <http://ldap2.example.com>.
> 
>> will sssd fallback properly to ldap2 if ldap1 does not respond ?
> 
> Yes, and in fact this is the recommended mechanism for setting up SSSD
> in your environment, since you need only to update the DNS records and
> all of your clients will have access to a new set of LDAP servers
> (i.e. if you provision additional ones and/or retire others).

Hmm, I really wonder why SRV RRs are recommended over having a single service
CNAME RR and maybe several A/AAAA RRs?

Especially I'm concerned whether the TLS hostname check is properley done in
case of TLS connections (StartTLS ext.op or LDAPS). Because a hostname check
has to be performed against *a-priori* knowledge of the client to fight
against MITM attacks with DNS spoofing.

So if you're local configuration just knows "example.com" the server cert MUST
have a subject alt name with that domain name. I doubt that LDAP clients
really check this.

Ciao, Michael.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2398 bytes
Desc: S/MIME Cryptographic Signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-users/attachments/20130925/84ef0cff/attachment-0001.p7s>


More information about the sssd-users mailing list