Mailing-List: contact dev-help@apr.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of covener@gmail.com designates
 209.85.220.181 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <A3D26396-C9B6-4C6B-AC66-EEDB69F91228@sharp.fm>
References: 
 <CAN9c_NTZBMBp5x70AnzT21eT3OcQYyge78JzLtmtoCYbr3RA=A@mail.gmail.com>
	<CALK=YjOM=+TABoh-RSUjYzirQYZPaw=KSWNbDt-_EGn-6w_KvA@mail.gmail.com>
	<A3D26396-C9B6-4C6B-AC66-EEDB69F91228@sharp.fm>
Date: Tue, 18 Feb 2014 15:52:28 -0500
Message-ID: 
 <CALK=YjMEhti61D_uD=aJyd0RqtjMCz+XTudtjyQDGMFtXqh6-A@mail.gmail.com>
Subject: Re: configuring apr-util --with-ldap against idsldap (aka tivoli)
From: Eric Covener <covener@gmail.com>
To: Graham Leggett <minfrin@sharp.fm>
Cc: APR Development List <dev@apr.apache.org>,
 Michael Felt <mamfelt@gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

For when we revisit, or maybe for Michael -- In APU, the immediate
problem with SSL is that apr_ldap_ssl_init happens before the
certificate options are set.  The underlying Tivoli toolkit wants info
about the global_certs passed into that call.

autoconf for basic stuff, not really used because we bake it into
httpd below: http://people.apache.org/~covener/patches/apuldap-itds1.diff
replacement we use instead of apr_ldap_ssl_init for tivoli:
http://people.apache.org/~covener/patches/tivoli_ssl_init.txt

On Tue, Feb 18, 2014 at 3:42 PM, Graham Leggett <minfrin@sharp.fm> wrote:
> On 18 Feb 2014, at 10:35 PM, Eric Covener <covener@gmail.com> wrote:
>
>> I (IBM) have some patches in this area that didn't make it to APR or HTT=
PD :(
>>
>> Unortunately Tivoli SSL initialization doesn't fit into how APU
>> initializes SSL and we are currently using hacks in both APU and
>> HTTPD.
>
> I am about half way through the APR v2.0 replacement of the API. Not only=
 is the init really tricky, with every toolkit out there having a unique va=
riation, but the bind has a bunch of variation too. Then there is the passi=
ng of binary objects which has toolkit specific definitions of lengths. It =
has made coming up with an API quite a challenge.
>
> My current biggest challenge is a pile of work I have that needs doing, s=
o can't look at it now alas.
>
> Regards,
> Graham
> --
>


--=20
Eric Covener
covener@gmail.com