Peter Marschall f0626a8dde LDAP auth: change 'ldap_ssl_verify_mode' to NONE for ldapi:// ...

For ldapi:// connections, which connect - by definition - to a local UNIX
socket, lower the value of config setting 'ldap_ssl_verify_mode' to "NONE"
to avoid certificate validation failures.
The UNIX socket address can NEVER match any DNS name from a certificate,
making the whole certificate validation moot.

This is a workaround for a limitation of Python's LDAP modules, that do not
consider this edge case.

2025-09-29 20:15:33 +02:00

21 KiB

Raw Blame History

View Raw