Re: [HACKERS] LDAPS

2017-11-12 Thread Thomas Munro
On Sat, Nov 4, 2017 at 2:05 AM, Thomas Munro wrote: > I've only tested the attached lightly on FreeBSD + OpenLDAP and > don't know if it'll work elsewhere. While rebasing this on top of a nearby changes, I looked into how portable it is. The previous version unconditionally used ldap_initialize(

Re: [HACKERS] LDAPS

2017-11-03 Thread Thomas Munro
On Sat, Nov 4, 2017 at 2:05 AM, Thomas Munro wrote: > That > said, I've only tested the attached lightly on FreeBSD + OpenLDAP and > don't know if it'll work elsewhere. Oops, that version's TAP test was a little too dependent on my system's ldap.conf file. Here's a version that sets the LDAPCONF

[HACKERS] LDAPS

2017-11-03 Thread Thomas Munro
Hi hackers, I've run into a few requests for $SUBJECT in the field. I understand that this is a bit controversial: LDAP + StartTLS (what we already support) is better than LDAPS because it's a proper standard, and LDAP auth in general is not as good as some other authentication methods that we sh