Revert "Require a minimum SASL security factor of 56"

This reverts commit 3509545897.

We cannot force increase in minimum SASL security factor until our
consumers are ready to deal with it. Unfortunately, realmd uses
anonymous connection for discovery and validation of IPA LDAP server.

The way it is done is fragile (it doesn't take into account an
advertised IPA version, only checks that 'IPA' string exists in the info
field) but since bumping of minimum SSF prevents reading IPA info field
using anonymous connection, client enrollment fails.

We should get back to bumping minimum SSF after realmd and other
potential consumers are fixed.

Reviewed-By: François Cami <fcami@redhat.com>
This commit is contained in:
Alexander Bokovoy
2019-05-01 21:25:31 +03:00
committed by François Cami
parent e73fdcf8ba
commit 294aa3a333
5 changed files with 2 additions and 38 deletions

View File

@@ -94,7 +94,6 @@ dist_app_DATA = \
ipa-kdc-proxy.conf.template \
ipa-pki-proxy.conf.template \
ipa-rewrite.conf.template \
min-ssf.ldif \
ipaca_default.ini \
ipaca_customize.ini \
ipaca_softhsm2.ini \

View File

@@ -1,14 +0,0 @@
# config
# pretend SSF for LDAPI connections
# nsslapd-localssf must be equal to or greater than nsslapd-minssf
dn: cn=config
changetype: modify
replace: nsslapd-localssf
nsslapd-localssf: 256
# minimum security strength factor for SASL and TLS
# 56 is considered weak, but some old clients announce wrong SSF.
dn: cn=config
changetype: modify
replace: nsslapd-minssf
nsslapd-minssf: 56