Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (asf.osuosl.org: local policy)
Message-Id: <441BDFE2.3235.00AC.0@novell.com>
Date: Sat, 18 Mar 2006 10:24:37 -0700
From: "Brad Nicholes" <bnicholes@novell.com>
To: <dev@httpd.apache.org>,<minfrin@sharp.fm>
Subject: Re: svn commit: r386776 - in
	/httpd/httpd/trunk/docs/manual/mod:mod_ldap.html.en
	mod_ldap.xml
References: <20060318004816.15893.qmail@minotaur.apache.org>
 <441BE7E2.8030801@sharp.fm>
In-Reply-To: <441BE7E2.8030801@sharp.fm>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline


>>> Graham Leggett <minfrin@sharp.fm> 3/18/2006 3:58:42 am >>>
trawick@apache.org wrote:

> URL: http://svn.apache.org/viewcvs?rev=3D386776&view=3Drev=20
> Log:
> LDAPConnectionTimeout and LDAPVerifyServerCert can be configured
> per-vhost
>
>We need to note in addition to this that not all LDAP SDK libraries=20
>support the concept of separately configurable "verify server cert"=20
>behaviour.
>
>In other words, even though you specify LDAPVerifyServerCert in LDAP=20
>connections from vhost A, you end up overriding this when you specify =
it=20
>in vhost B.
>
>This affects people using the Novell SDK.
>
>I think putting a note in the directive pointing people to=20
>http://httpd.apache.org/docs/2.2/mod/mod_ldap.html#settingcerts will=20
>save some questions on mailing lists.
>
>Regards,
>Graham
>--

Now that you mention it, allowing LDAPVerifyServerCert and LDAPConnectionTi=
meout to be overwritten in a vhost is still wrong.  According to the code, =
none of the SDKs support setting verify server cert on a per-connection =
basis, therefore GLOBAL_ONLY needs to be put back on this directive and =
vhost merging needs to be modify to reflect that.  The connection time out =
appears to be supported per-connection for the OpenLDAP SDK but the Novell =
LDAP SDK only supports it on a global basis.  I would suggest that we make =
LDAPConnectionTimeout GLOBAL_ONLY also since having the ability to set the =
timeout on a vhost basis has little value anyway.

Brad