Re: SASL EXTERNAL binds and sasl-secprops minssf > 0

[Quanah Gibson-Mount <quanah@symas.com>]

--On Saturday, August 05, 2017 3:05 PM -0400 David Hawes <dhawes@gmail.com> 
wrote:

> With ITS #8568 [1], I notice that the first SASL EXTERNAL (using TLS
> client auth) bind on a connection succeeds, but subsequent SASL
> EXTERNAL binds on the same connection fail with:
>
> slapd[31088]: conn=1009 op=3 RESULT tag=97 err=48 text=SASL(-15):
> mechanism too weak for this user: mech EXTERNAL is too weak

Please file an ITS for this, thanks.  I would think the expected behavior 
for SASL/EXTERNAL is the SASL SSF matches the TLS SSF, given it's a TLS 
encrypted connection.

--Quanah



--

Quanah Gibson-Mount
Product Architect
Symas Corporation
Packaged, certified, and supported LDAP solutions powered by OpenLDAP:
<http://www.symas.com>