[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: ldaprc with ldaps:// and ldap:// fallback



On 25/06/10 05:29 +0200, Emmanuel Dreyfus wrote:
Dan White <dwhite@olp.net> wrote:

Try:

TLS_REQCERT: try

In this case, EXTERNAL should only be offered after successful TLS
negotiation, or over a unix domain socket.

If TLS negotiation fails, then a SASL bind won't work without selecting
another mechanism.

But Idap.conf(5) says "The  server  certificate  is requested. If no
certificate is provided, the  session  proceeds  normally. ", which
suggests that the TLS negociation may succeed without a server
certificate being sent. Is that wrong?

SASL EXTERNAL will only be offered if the server can identify you, or
derive an authentication identity, which it can never do if TLS does not
succeed - since it derives your identity from the contents of the client
certificate.

--
Dan White