diff options
| author | Rich Megginson <rmeggins@redhat.com> | 2009-03-16 16:29:45 +0000 |
|---|---|---|
| committer | Rich Megginson <rmeggins@redhat.com> | 2009-03-16 16:29:45 +0000 |
| commit | 2ede6dec55989ddf76c38360e929971ae6360b27 (patch) | |
| tree | bd1afeb1805fe3cc828f34c37d4582905756127b /ldap | |
| parent | 21f449f1164507962bfceaa456c30186f97737f6 (diff) | |
| download | ds-2ede6dec55989ddf76c38360e929971ae6360b27.tar.gz ds-2ede6dec55989ddf76c38360e929971ae6360b27.tar.xz ds-2ede6dec55989ddf76c38360e929971ae6360b27.zip | |
Resolves: bug 479254
Bug Description: Configuring Replication Server to Server GSSAPI over TLS - attempts replication and can't stop servers
Reviewed by: nhosoi (Thanks!)
Fix Description: The agreement add code did not check the transport and bind method for compatability.
Platforms tested: RHEL5
Flag Day: no
Doc impact: no
Diffstat (limited to 'ldap')
| -rw-r--r-- | ldap/servers/plugins/replication/repl5_agmt.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/ldap/servers/plugins/replication/repl5_agmt.c b/ldap/servers/plugins/replication/repl5_agmt.c index 19393c06..613c222a 100644 --- a/ldap/servers/plugins/replication/repl5_agmt.c +++ b/ldap/servers/plugins/replication/repl5_agmt.c @@ -207,6 +207,20 @@ agmt_is_valid(Repl_Agmt *ra) "is malformed: invalid pausetime %ld.\n", slapi_sdn_get_dn(ra->dn), ra->pausetime); return_value = 0; } + if ((0 != ra->transport_flags) && (BINDMETHOD_SASL_GSSAPI == ra->bindmethod)) { + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Replication agreement \"%s\" " + " is malformed: cannot use SASL/GSSAPI if using SSL or TLS - please " + "change %s to LDAP before changing %s to use SASL/GSSAPI\n", + slapi_sdn_get_dn(ra->dn), type_nsds5TransportInfo, type_nsds5ReplicaBindMethod); + return_value = 0; + } + if ((0 == ra->transport_flags) && (BINDMETHOD_SSL_CLIENTAUTH == ra->bindmethod)) { + slapi_log_error(SLAPI_LOG_FATAL, repl_plugin_name, "Replication agreement \"%s\" " + " is malformed: cannot use SSLCLIENTAUTH if using plain LDAP - please " + "change %s to SSL or TLS before changing %s to use SSLCLIENTAUTH\n", + slapi_sdn_get_dn(ra->dn), type_nsds5TransportInfo, type_nsds5ReplicaBindMethod); + return_value = 0; + } return return_value; } |