Description of problem:

I have configured passthrough plugin to do Starttls:


nsslapd-pluginarg0: ldap://nslcd.parente.local:1389/dc=parente,dc=local 3,5,30
 0,3,300,1


I have added plugin debug logs. To have that login, I had to define this in source code and re-build:

#define    PASSTHRU_VERBOSE_LOGGING 

Then I see clearly:

passthru-plugin - PTA server host: "nslcd.parente.local", port: 1389, secure: 2, maxconnections: 3, maxconcurrency: 5, timeout: 300, ldversion: 3, connlifetime: 300

secure: 2 means starttls:


        if (starttls) {
            srvr->ptsrvr_secure = 2;
        }


bind as:

ldapsearch -D "uid=omc,ou=people,dc=parente,dc=local" -w secret12 -b "dc=parente,dc=local" -s base


But in the access logs, we see clearly:

[23/May/2018:10:07:20.883924603 -0400] conn=1 fd=64 slot=64 connection from 10.10.178.222 to 10.10.178.222
[23/May/2018:10:07:20.884685945 -0400] conn=1 op=0 BIND dn="uid=omc,ou=people,dc=parente,dc=local" method=128 version=3
[23/May/2018:10:07:20.886823710 -0400] conn=1 op=0 RESULT err=0 tag=97 nentries=0 etime=0.0002572394 dn="uid=omc,ou=people,dc=parente,dc=local"

No startls.

Now, in the code, when parsing the url:

    /* use secure setting from url if none given */
    if (!secure && ludp) {
        if (secureurl) {
            secure = SLAPI_LDAP_INIT_FLAG_SSL;
        } else if (0 /* starttls option - not supported yet in LDAP URLs */) {
            secure = SLAPI_LDAP_INIT_FLAG_startTLS;
        }
    }

So, I wonder if the problem is not that the starttls is not supported in ldap urls but ... in the passthrough plugin we cannot but specify ldapurl



Version-Release number of selected component (if applicable):

389-ds-base-1.3.7.5-21.el7_5