diff options
| author | Simo Sorce <simo@redhat.com> | 2017-03-06 14:19:30 -0500 |
|---|---|---|
| committer | Simo Sorce <simo@redhat.com> | 2017-03-06 14:19:30 -0500 |
| commit | 34553627ebd709dea371030b03607c9c167732b0 (patch) | |
| tree | 819ffde332f7aa7764139b71de8e65edc9c85c1e | |
| parent | 513c118d741594bf6bab6302a4b24c23168c4c44 (diff) | |
| download | freeipa-34553627ebd709dea371030b03607c9c167732b0.tar.gz freeipa-34553627ebd709dea371030b03607c9c167732b0.tar.xz freeipa-34553627ebd709dea371030b03607c9c167732b0.zip | |
Use GSS-SPNEGO if connecting locally
GSS-SPNEGO allows us to negotiate a sasl bind with less roundrtrips
therefore use it when possible.
We only enable it for local connections for now because we only
recently fixed Cyrus SASL to do proper GSS-SPNEGO negotiation. This
change means a newer and an older version are not compatible.
Restricting ourselves to the local host prevents issues with
incomaptible services, and it is ok for us as we are only really lloking
at speedups for the local shortlived connections performed by the
framework. Most other clients have llonger lived connections, so
peformance improvements there are not as important.
Signed-off-by: Simo Sorce <simo@redhat.com>
| -rw-r--r-- | ipapython/ipaldap.py | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py index 82d45b9a7..b15859892 100644 --- a/ipapython/ipaldap.py +++ b/ipapython/ipaldap.py @@ -52,6 +52,7 @@ if six.PY3: # Global variable to define SASL auth SASL_GSSAPI = ldap.sasl.sasl({}, 'GSSAPI') +SASL_GSS_SPNEGO = ldap.sasl.sasl({}, 'GSS-SPNEGO') _debug_log_ldap = False @@ -1112,7 +1113,10 @@ class LDAPClient(object): Perform SASL bind operation using the SASL GSSAPI mechanism. """ with self.error_handler(): - auth_tokens = ldap.sasl.sasl({}, 'GSSAPI') + if self._protocol == 'ldapi': + auth_tokens = SASL_GSS_SPNEGO + else: + auth_tokens = SASL_GSSAPI self._flush_schema() self.conn.sasl_interactive_bind_s( '', auth_tokens, server_controls, client_controls) |