Re: Problem with ldap table lookups and TLS

2009-03-03 Thread Wietse Venema
Victor Duchovni: With OpenLDAP 2.4 it is possible to set the TLS properties for a particular LDAP connection (not just global properties), and to associate a new OpenLDAP managed TLS context for the connection via the new LDAP_OPT_X_TLS_NEWCTX option. Try this completely untested patch (it

Re: Problem with ldap table lookups and TLS

2009-03-03 Thread Victor Duchovni
On Tue, Mar 03, 2009 at 07:30:39PM -0500, Wietse Venema wrote: Victor Duchovni: With OpenLDAP 2.4 it is possible to set the TLS properties for a particular LDAP connection (not just global properties), and to associate a new OpenLDAP managed TLS context for the connection via the new

Re: Problem with ldap table lookups and TLS

2009-02-27 Thread Quanah Gibson-Mount
--On Wednesday, February 25, 2009 7:12 PM -0500 Victor Duchovni victor.ducho...@morganstanley.com wrote: Note, the OpenLDAP API design issue is resolved with OpenLDAP 2.4. With OpenLDAP 2.4 it is possible to set the TLS properties for a particular LDAP connection (not just global

Re: Problem with ldap table lookups and TLS

2009-02-27 Thread Victor Duchovni
On Fri, Feb 27, 2009 at 09:35:39AM -0800, Quanah Gibson-Mount wrote: --On Wednesday, February 25, 2009 7:12 PM -0500 Victor Duchovni victor.ducho...@morganstanley.com wrote: Note, the OpenLDAP API design issue is resolved with OpenLDAP 2.4. With OpenLDAP 2.4 it is possible to set the TLS

Re: Problem with ldap table lookups and TLS

2009-02-27 Thread Victor Duchovni
On Fri, Feb 27, 2009 at 09:35:39AM -0800, Quanah Gibson-Mount wrote: If you are unable to test this patch at this time, I can do some testing on my systems using OpenLDAP 2.4.15 Postfix 2.5.6. The patch is working for me, please confirm that it is working for you also. It is simple enough

Re: Problem with ldap table lookups and TLS

2009-02-25 Thread Victor Duchovni
On Wed, Feb 25, 2009 at 03:30:51PM -0600, Nick Geron wrote: Well, I have found my problem. I probably should have mentioned earlier (how many times has than appeared on this list?) that ldap is used on this system for local user authentication, meaning pam/nss are tied into ldap. I

Re: Problem with ldap table lookups and TLS

2009-02-25 Thread Nick Geron
Victor Duchovni wrote: On Wed, Feb 25, 2009 at 03:30:51PM -0600, Nick Geron wrote: Well, I have found my problem. I probably should have mentioned earlier (how many times has than appeared on this list?) that ldap is used on this system for local user authentication, meaning pam/nss are

Re: Problem with ldap table lookups and TLS

2009-02-25 Thread Victor Duchovni
On Wed, Feb 25, 2009 at 05:34:26PM -0600, Nick Geron wrote: This is an OpenLDAP API design issue. The OpenLDAP library (at least up to version 2.3) has a single global SSL_CTX object, that is initialized just once by the first call that creates an SSL-protected LDAP connection. All requests

Problem with ldap table lookups and TLS

2009-02-24 Thread Nick Geron
I'm in the process of putting together a postfix system with an ldap back-end and have come across something very odd regarding ldap_table. Basically, postfix does not load my private CA. The CA is really a self signed cert generated by java keytool - try as I might, I couldn't get keytool to

Re: Problem with ldap table lookups and TLS

2009-02-24 Thread Quanah Gibson-Mount
--On Tuesday, February 24, 2009 6:48 PM -0600 Nick Geron nge...@corenap.com wrote: I'm in the process of putting together a postfix system with an ldap back-end and have come across something very odd regarding ldap_table. Basically, postfix does not load my private CA. The CA is really a

Re: Problem with ldap table lookups and TLS

2009-02-24 Thread Victor Duchovni
On Tue, Feb 24, 2009 at 06:48:12PM -0600, Nick Geron wrote: So as root or my limited rights postfix user this works: #postmap -q j...@example.com ldap:/etc/postfix/ldap/aliases.cf j...@example.com You only show a test running as root, not postfix. What versions of Postfix and OpenLDAP are