no TLS support

[Maciej Kazulak]

Hi,

If i'm correct it is not possible to use TLS connections in the current version.

The make_ldap_connection function uses only the ldap_connection config setting which is supposed to be a RFC4156 compilant URL. But RFC4156 does not even mention TLS. According to python-ldap documentation to enable TLS:

>>> import ldap
>>> con = ldap.initialize('ldap://localhost')
>>> con.set_option(ldap.OPT_X_TLS_DEMAND, 1)

The default in python-ldap seems to be not to use TLS (even if it might be availible). There should probably be a config setting start_tls or so with possible values of at least: never (default for compatibility?), allow, demand. Another cool touch would be server certificate verification.

I might be following with a short patch.

[Maciej Kazulak (kazulakm)]

Ok, sorry for that. I might have misread the docs.

"By passing an existing LDAPObject, you're free to use the LDAP authentication method you want, the way you want."

Still doesn't that mean i have to configure everything in python code to have TLS? Maybe a config setting should be provided for convienice then... No one uses unencrypted connections in production and for whatever reasons SSL is not always enabled.

[Gustavo Narea (gnarea)]

This has been fixed in the following branch, which is going to be released this week:
https://code.launchpad.net/~gnarea/repoze.who.plugins.ldap/1.1proposal