STARTTLS support for LDAP

[Quintus]

Hi everyone,

okay, I have an OpenLDAP server running here that I want to use for authentication. Problem: It does not allow unencrypted connections. It does not allow LDAPS either. It wants STARTTLS (RFC 4513) for connection.

The ejabberd docs state this:

Note that STARTTLS encryption is not supported.

Since the docs do not state any reasons for that I searched, but all I found was this ML thread from 2013, which seems to have yielded no result.

So what’s the state of STARTTLS support for LDAP authentication in ejabberd? I’m running ejabberd 15.09 on Debian Jessie, Erlang/OTP 17.3.

Greetings,
Marvin

[badlop]

As mentioned in the ejabberd Guide, the LDAP code supports only TLS encryption, not STARTTLS:

ldap_encrypt: none|tls: Type of connection encryption to the LDAP server. Allowed values are: none, tls. The value tls enables encryption by using LDAP over SSL. Note that STARTTLS encryption is not supported. The default value is: none.

[Quintus]

On Tue, Aug 01, 2017 at 10:15:18AM +0000, badlop wrote: As mentioned in the ejabberd Guide, the LDAP code supports only TLS encryption, not STARTTLS [...]

Certainly. I know this documentation. The question was whether it is planned to include StartTLS support at some point (i.e. this is a feature request, not a bug report). Marvin

…

-- Blog: https://www.guelkerdev.de PGP/GPG ID: F1D8799FBCC8BC4F

[sbraz]

Hello @badlop, is it possible to reopen this? StartTLS support would be a useful feature.

[cromain]

STARTTLS is becoming obsolete in every software, and we support TLS. So we do not plan to spend efforts on STARTTLS.

[sbraz]

@cromain ldaps was never standardised, STARTTLS is the non-deprecated one:

ldaps:// is deprecated in favor of Start TLS [RFC2830]. OpenLDAP 2.0 supports both.

https://www.openldap.org/faq/data/cache/605.html

[zinid]

I wonder what should be standardized there. Also, are there LDAP servers without direct TLS support?

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.