Bug 1044134 – [RFE] should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1044134 - [RFE] should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default

Summary:	[RFE] should set LDAP_OPT_X_SASL_NOCANON to LDAP_OPT_ON by default

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	389-ds-base (Show other bugs)
Sub Component:
Version:	7.0
Hardware:	Unspecified Unspecified

Priority	low Severity unspecified
Target Milestone:	rc
Target Release:	---
Assigned To:	Rich Megginson
QA Contact:	Viktor Ashirov
Docs Contact:

URL:
Whiteboard:
Keywords:	FutureFeature

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2013-12-17 16:14 EST by Nathan Kinder
Modified:	2015-03-05 04:29 EST (History)
CC List:	3 users (show)

See Also:
Fixed In Version:	389-ds-base-1.3.3.1-1.el7
Doc Type:	Enhancement
Doc Text:	Feature: Add ability to set the ldap connection "no canon" settings Reason: Have the ability to avoid doing DNS reverse lookups for outgoing connections. Result: More fine grained control over how the server makes connections.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2015-03-05 04:29:34 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2015:0416	normal	SHIPPED_LIVE	Important: 389-ds-base security, bug fix, and enhancement update	2015-03-05 09:26:33 EST

Groups: None (edit)

Description Nathan Kinder 2013-12-17 16:14:23 EST

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/389/ticket/47317

389 should use ldap_set_option(ld, LDAP_OPT_X_SASL_NOCANON, LDAP_OPT_ON) for outgoing ldap connections.  This option should also be configurable via a configuration attribute, with the value of "on" by default.

http://ssimo.org/blog/id_015.html

Comment 4 Amita Sharma 2014-12-30 04:57:20 EST

[root@dhcp201-126 export]# ldapsearch -p 389 -h localhost -D "cn=Directory Manager" -w Secret123 -LLL -b "cn=config" | grep nsslapd-connection-nocanon
nsslapd-connection-nocanon: on

Hence VERIFIED,

Comment 6 errata-xmlrpc 2015-03-05 04:29:34 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-0416.html

Note You need to log in before you can comment on or make changes to this bug.