| Summary: | tls_reqcert try has bad behavior | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | David Spurek <dspurek> | |
| Component: | openldap | Assignee: | Jan Synacek <jsynacek> | |
| Status: | CLOSED ERRATA | QA Contact: | Eduard Benes <ebenes> | |
| Severity: | medium | Docs Contact: | ||
| Priority: | medium | |||
| Version: | 7.0 | CC: | ebenes, jsynacek, pkis | |
| Target Milestone: | rc | |||
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | openldap-2.4.39-5.el7 | Doc Type: | Bug Fix | |
| Doc Text: |
Cause: Confusing description in the manual page.
Consequence: The user might be confused about the real behavior.
Fix: Fix the description in the man page.
Result: The man page description is now correct.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1027618 1027796 (view as bug list) | Environment: | ||
| Last Closed: | 2015-03-05 13:35:25 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Bug Depends On: | ||||
| Bug Blocks: | 1027618, 1027796 | |||
if TLS_REQCERT allow is set then ldapsearch pass. TLS_REQCERT try and allow should have the same behavior in case if no ca cert is specified (according to description in man ldap.conf). First observation: TLS_REQCERT has no effect if you use ldapsearch with -Z[Z]. This probably works as it should, see http://www.openldap.org/its/index.cgi?findid=7206. I couldn't configure the server so it "provides no certificate" and connect to it using the ldapsearch client. The manpage is talking about server certificates, TLS_CACERT and TLS_CACERTDIR are CA certificates that the client should use, therefore removing them is not relevant. Upstream discussion at http://www.openldap.org/lists/openldap-technical/201311/msg00099.html. Conclusion: the manpage should be fixed. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-0597.html |
Description of problem: 'tls_reqcert try' option has bad behavior on client side. It should allow connection if certificate is not specified. man page says: try The server certificate is requested. If no cer‐ tificate is provided, the session proceeds nor‐ mally. If a bad certificate is provided, the ses‐ sion is immediately terminated. Version-Release number of selected component (if applicable): openldap-2.4.35-6.el7 How reproducible: always Steps to Reproduce: 1.Setup ldap server with certificates 2.remove all TLS_CACERT and TLS_CACERTDIR from /etc/openldap/ldap.conf 3.set TLS_REQCERT try to /etc/openldap/ldap.conf 4. try ldapsearch -ZZ -x -H ldap://<server_name> '*' Actual results: ldapsearch fail: ldap_start_tls: Connect error (-11) additional info: TLS error -8172:Peer's certificate issuer has been marked as not trusted by the user. Expected results: ldapsearch should pass Additional info: