Re: Disallow ldap operations without start_tls

To: Quanah Gibson-Mount <quanah@zimbra.com>, openldap-technical@openldap.org
Subject: Re: Disallow ldap operations without start_tls
From: Joshua Schaeffer <jschaeffer0922@gmail.com>
Date: Mon, 15 Feb 2016 16:40:11 -0700
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-type:content-transfer-encoding; bh=XaY559grlzUFr0Q8emJDBdqNOZskNpBN8HIaMEt3BXo=; b=kXmUb1BsMpjljYz/us7BF+CGp3SlPMMZ1qddp8UYhCW9GlARQP2zYW0rFB2MWPbcUt GpAcvXjND5HlhcjcE9GJLcgWZzepQNyPuKpKRGkmSUEePDa2NLd1ZUH8NCVXOO2818Cn jlEJtCdGNf0z8e3ZYHVSI00nwdsuzxH4o0JBLb82D9OTwMUY0JsR6wOk31bqZscNW+aW 7ka2kfcJD30tNm7Dtt5fTL6LSFLY6UwdhJVXApEwLOPVm5p1ABbOVtotFcPkp39e6yLo dUBAltmxR3KFW+rf9lSKryooT+ltOVPlOIiQYyLuhAeZhsNEJODQUvFqoh+9fFteTqKL LVIw==
In-reply-to: <B355B11A0D746772864DBA46@[192.168.1.9]>
References: <56C243ED.2070402@gmail.com> <B355B11A0D746772864DBA46@[192.168.1.9]>
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1

On 02/15/2016 02:50 PM, Quanah Gibson-Mount wrote:

--On Monday, February 15, 2016 2:32 PM -0700 Joshua Schaeffer <jschaeffer0922@gmail.com> wrote:

Is there any way to force clients to use start_tls without sending any
credentials over the wire


No, unfortunately that was not taken into consideration when the LDAP v3 spec was written.


Okay good to know. Thanks for the quick reply.

Joshua

References:
- Disallow ldap operations without start_tls
  - From: Joshua Schaeffer <jschaeffer0922@gmail.com>
- Re: Disallow ldap operations without start_tls
  - From: Quanah Gibson-Mount <quanah@zimbra.com>