Re: Cannot start kerberos signing/sealing when using TLS/SSL

Hi Graham,

agreed. Anyhow, I stumbled accross that problem, too - could you perhaps mention it in the documentation?
Is there any security risk connected to setting maxssf to 0 with ldaps?

Best regards,
        Markus


On Nov 17, 2009, Graham Barr wrote:
> On Nov 15, 2009, at 3:09 PM, Markus Moeller wrote:
> > I think this would fix it
>
> you you maybe, but I suspect someone else would not want that.
>
> I suggest you look at the next branch in the repository
>
> http://github.com/gbarr/perl-ldap/tree/next/
>
> using this you can call $sasl->client_new and set the property in your own code
> before passing to ->bind
>
> Graham.
>
> >
> >
> > --- LDAP.pm     2008-10-27 20:05:58.000000000 +0000
> > +++ LDAP.pm.new 2009-11-15 21:07:49.000000000 +0000
> > @@ -397,6 +397,9 @@
> >      sockname => $ldap->{net_ldap_socket}->sockname,
> >      peername => $ldap->{net_ldap_socket}->peername,
> >    );
> > +    $sasl_conn->property(
> > +      maxssf => 0,
> > +    ) if ($ldap->{scheme} eq 'ldaps'),
> >
> >    my $initial = $sasl_conn->client_start;
> >
> >
> > Markus
... rest deleted ...




Markus Jansen

Ericsson GmbH
Eurolab R&D
Ericsson Allee 1
52134 Herzogenrath, Germany
Phone +49 2407 575 5157
Fax +49 22407 575 150
Mobile +49 172 2742003
[email protected]
www.ericsson.com



Ericsson GmbH. Sitz: Düsseldorf. Registergericht: Amtsgericht Düsseldorf, HRB 33012. Geschäftsführer: Stefan Koetz (Vors.), Nils de Baar, Bernd Schmidt. Aufsichtsratsvorsitzender: Anders Runevad.

This Communication is confidential. We only send and receive email on the basis of the terms set out at www.ericsson.com/email_disclaimer<http://www.ericsson.com/email_disclaimer>.