ssl config option for LDAP mapper has confusing values about pam_pkcs11 HOT 6 OPEN

Why not. The new code should not break existing configurations using ssl and tls in the configuration.

Can you propose a patch?

from pam_pkcs11.

Before anything else I would like to reach an agreement what these configuration values actually mean.

• "ssl" is actually "ldaps"
• "tls" is actually "starttls"
• "on" is the same as "ldaps"
• "off" is plaintext

Is that correct?

from pam_pkcs11.

No idea.You should check the source code.

from pam_pkcs11.

Source code is pretty clear in ldap_mapper.c starting line 1143:

ssltls = scconf_get_str(blk,"ssl","off");
if (! strncasecmp (ssltls, "tls", 3))
ssl_on = SSL_START_TLS;
else if( ! strncasecmp (ssltls, "on", 2))
ssl_on = SSL_LDAPS;
else if( ! strncasecmp (ssltls, "ssl", 3))
ssl_on = SSL_LDAPS;

and default value at line 113:

static ldap_ssl_options_t ssl_on = SSL_OFF;

from pam_pkcs11.

I could not find the documentation about ssl = ... configuration in doc/README.ldap_mapper
Maybe the best is to better document the configuration field ssl =in https://github.com/OpenSC/pam_pkcs11/blob/master/doc/pam_pkcs11.xml#L1824

Can you propose a patch?

from pam_pkcs11.

See https://github.com/OpenSC/pam_pkcs11/blob/master/README.md

from pam_pkcs11.