[Date Prev][Date Next]
Re: (ITS#8364) [PATCH] back-meta idassert-bind tls_reqcert=never bug
- To: openldap-its@OpenLDAP.org
- Subject: Re: (ITS#8364) [PATCH] back-meta idassert-bind tls_reqcert=never bug
- From: email@example.com
- Date: Sun, 31 Jan 2016 16:39:34 +0000
- Auto-submitted: auto-generated (OpenLDAP-ITS)
> Full_Name: Mohammad Nweider
> Version: master
> OS: Redhat Linux
> URL: https://www.securiteam.io/contribs/openldap/mohammad-20160131-0001-fix-backmeta-idassertbind-tlsreqcert-never-bug.patch
> Submission from: (NULL) (184.108.40.206)
> We've found a small bug when trying to run openldap with meta backend, what we
> were trying to achieve is to have our server listens on ssl/tls port and to
> communicate with the meta targets over ssl/tls as well, but due to the fact that
> we're using a self-signed certificate and we don't have access to manage the
> meta targets, we wanted to skip the client certificate verification when
> connecting to the meta targets, so we tried adding idassert-bind
> tls_reqcert=never to our meta config for this purpose, but unfortunately it
> didn't work as expected.
There is no bug here. The tls_reqcert setting controls whether the local node
requires the remote target to provide a valid server certificate. It has
nothing to do with client certificates at all.
> Whenever openldap has a certificate/key either in
> TLSCertificateFile/TLSCertificateKeyFile or in idassert-bind tls_cert/tls_key
> settings, it completely ignores tls_reqcert in idassert-bd%d!
Because the reqcert setting has nothing to do with this.
Closing this ITS.
-- Howard Chu
CTO, Symas Corp. http://www.symas.com
Director, Highland Sun http://highlandsun.com/hyc/
Chief Architect, OpenLDAP http://www.openldap.org/project/