While bind-dyndb-ldap always relies on SASL GSSAPI authentication in FreeIPA setting because it uses LDAPI connection on IPA masters, it makes sense to allow setting up StartTLS for LDAP connection.

There is already a code in FreeIPA to properly configure StartTLS: https://pagure.io/freeipa/blob/master/f/util/ipa_ldap.c#_73

What is also needed on bind-dyndb-ldap side is to allow specifying CA certificate

We'll work on it upstream and then QE might find time to bring it in RHEL 8.x.

bind-dyndb-ldap already works with LDAPS (LDAP over TLS) URIs just fine. I have tested LDAPS connection on one of my test servers by replacing

    uri "ldapi://%2fvar%2frun%2fslapd-IPA-EXAMPLE.socket";

with

    uri "ldaps://master.ipa.example";

in /etc/named.conf. named-pkcs11.service restarted without a problem and successfully connected to 389-DS instance on master.ipa.example:636. Since bind-dyndb-ldap is a standard OpenLDAP client, the LDAP connector uses the TLS certificate /etc/ipa/ca.crt as configured in /etc/openldap/ldap.conf.

I propose to not implement StartTLS and rather document how to use bind-dyndb-ldap with LDAPS. To modify settings like CA certificate a customer can point the env var LDAPCONF to a custom LDAP conf with a systemd drop-in file.

I'd go even further here.

We do not need LDAPS or startTLS here because we use SASL GSSAPI and CyrusSASL will always trigger integrity check and encryption of the resulting connection. Thus, as soon as connection was bound, the trafic is encrypted.

While it really depends on what SASL library is in use and what version of it is in use and what mechanisms are in use, CyrusSASL is what we use in Fedora/RHEL/CentOS and OpenLDAP libraries are built against it.

GSSAPI and GSS-SPNEGO mechanisms implemented in CyrusSASL weren't able to set proper SSF value based on the underlying Kerberos encryption type until this patch landed in 2.1.27: https://github.com/cyrusimap/cyrus-sasl/commit/4b0306dcd76031460246b2dabcb7db766d6b04d8, and it only supports discovering SSF for MIT Kerberos.

Red Hat did backport this to older CyrusSASL versions, so RHEL 6-8 versions have it.

We have to use SASL because we are operating under Kerberos-bound identity that has permissions to modify DNS entries in LDAP.

So I'd rather use this ticket to add an ipa-advise scenario which automatically configures an enrolled IPA client to be a DNS slave against IPA masters. We need to figure out DNSSEC part and create special permissions that cover the required operations to pick up the keys from LDAP.

We've reevaluated the ticket again. 

As comments above suggest alternative solutions already should work so it might help. From the ticket description is not clear why this feature is needed. Base on this, we are closing the ticket.

Please reopen with the reasoning why it is needed if there is a a use case where current solution is not sufficient.