[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Disallow ldap operations without start_tls



Joshua Schaeffer wrote:
Michael Ströder wrote:

Simply use LDAPS (on separate port). It was never defined in a standard but
most
LDAP-enabled software supports it.

I did ended up doing this. I had an application that didn't support start_tls
on an ldap URI, but did support ldaps (or at least I couldn't find a way to
get it to issue start_tls).

In OpenLDAP's libldap just use a URL extension:

 ldap://host/????starttls

--
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/