qua...@zimbra.com wrote: > --On Tuesday, June 12, 2012 11:25 AM -0700 Howard Chu <h...@symas.com> wrote: >> Tough luck. Currently ldap:/// means localhost. Changing the library >> behavior here would be a pretty drastic incompatible change and would >> break pretty much all existing software. This has been discussed and shot >> down before, and rejecting this request is the only correct outcome for >> this ITS. > > What about an ldap_set_option() parameter for enabling it?
Given the fact that there's no standard with appropriate security considerations clearly saying e.g. what should be done in case of StartTLS and hostname check I would also leave it up to the application to do the DNS lookup itself. I think people asking for including that feature into libldap should first try to implement it themselves taking into account all security implications when relying on DNS. Several existing approaches are IMO flawed. Ciao, Michael.
