Re: ldaprc with ldaps:// and ldap:// fallback

[Dan White <dwhite@olp.net>]

On 24/06/10 11:57 +0200, Emmanuel Dreyfus wrote:
> Dieter Kluenter <dieter@dkluenter.de> wrote:
>
> > No, ldapi:/// doesn't present a certificate, but you may establish a
> > startTLS session to ldapi:///, in this case the client requests a
> > server certificate.
>
> Let me rephrase: I would like to specify two LDAP servers in ldaprc 
> - one ldapi:/// with anonymous bind
> - one ldaps:// with SASL EXTERNAL for and required server certificate
>
> It seems to me it is not possible.

You could do SASL EXTERNAL over both, with ldapi:/// using Unix peercred,
i.e.:

authz-regexp
  ".*uidNumber=([^,]+),cn=peercred,cn=external,cn=auth"
  ldap:///ou=People,dc=example,dc=net??one?(uidNumber=$1)

--
Dan White