Re: Cannot start kerberos signing/sealing when using TLS/SSL
[email protected] ("Markus Moeller")
| Newsgroups | perl.ldap |
|---|---|
| Message-ID | <[email protected]> |
It might be an AD setting (enforcing SSL). But does it make sense to use SASL/GSSAPI encryption on top of SSL ? An option would be definitely the best. Thank you Markus "Quanah Gibson-Mount" <[email protected]> wrote in message news:E016E53A28E2FEB16294F53C@[192.168.1.199]... > --On Sunday, November 15, 2009 9:09 PM +0000 Markus Moeller > <[email protected]> wrote: > >> I think this would fix it > > I think AD must be broken and non RFC compliant. I've never had problems > using SASL/GSSAPI encryption at the same time as SSL/TLS encryption. It > wouldn't be the first time MS AD was broken in obvious ways. > > For example, here is startTLS over ldap with SASL/GSSAPI encryption: > > ldap1:/root# ldapsearch -ZZ -h ldap.stanford.edu -b "" -s base > SASL/GSSAPI authentication started > SASL username: [email protected] > SASL SSF: 56 > SASL data security layer installed. > # extended LDIF > # > > As such, I would suggest your patch as is be rejected. An option to > disable the SASL SSF should be supported though. > > --Quanah > > > -- > > Quanah Gibson-Mount > Principal Software Engineer > Zimbra, Inc > -------------------- > Zimbra :: the leader in open source messaging and collaboration >