Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

This project is now read‑only. Starting Monday, February 2, please use https://ibm-ceph.atlassian.net/ for all bug tracking management.

Bug 1596909

Summary:	CONFIGURING LDAP AND CEPH OBJECT GATEWAY -- TLS_REQCERT may be needed on remote sites.
Product:	[Red Hat Storage] Red Hat Ceph Storage	Reporter:	Warren <wusui>
Component:	Documentation	Assignee:	Jennifer Patton <jpatton>
Status:	CLOSED NOTABUG	QA Contact:	ceph-qe-bugs <ceph-qe-bugs>
Severity:	unspecified	Docs Contact:	Erin Donnelly <edonnell>
Priority:	unspecified
Version:	3.0	CC:	asriram, edonnell, kdreyer, pasik, tchandra
Target Milestone:	z2
Target Release:	3.2
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-04-24 17:24:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1685931

Description Warren 2018-06-30 04:35:29 UTC

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/3/html/ceph_object_gateway_with_ldapad_guide/rgw-ldap-config#configuring_ldaps

The install document recommended that TLS_REQCERT not be set in /etc/openldap/ldap.conf.  I think that it should be set to ‘allow’ on remote sites.

So
In section 1.4 under the heading of  "For RHEL 7, perform the following steps:" Item 2 should probably read:

On the LDAP server confirm that /etc/openldap/ldap.conf does not have TLS_REQCERT set.  If you are installing on a remote client machine, set TLS_REQCERT is set to 'allow'

Comment 8 Warren 2019-04-23 21:06:17 UTC

I think that Tejas is correct in that the document at this point is only concerned with the server.  So the text there is correct.  I will look around a little bit and see if there should be some information added elsewhere.  It may be the case that things are fine as it currently is.  I'll comment more a little later today.

Comment 9 Warren 2019-04-24 01:25:47 UTC

After looking this over, I think that we should revert this message to the original text.  Sorry for the confusion / extra work.

The problem that I ran into was something that occurred on my local machine.  I used this as a work around and later, since it was what I needed to get my test to work, I filed it as a bug.  I think that it is best to not mention this at all since it
is probably not a recommended thing to do outside of a test environment.