Re: DNS feature doesn't work with LDAPS

[Michael Ströder <michael [at] stroeder.com>]

On 11/18/21 00:23, Arthur de Jong wrote:
> Also, since nslcd expands the SRV record to URIs and then passes those
> to the LDAP library they are subject to the normal certificate name
> verification. Using DNS SRV records in that sense shouldn't be
> different from A records from a security perspective (but DNSSEC
> validation is always better).

Nope.

Let's assume nslcd.conf contains

uri ldaps://dc=example,dc=com

and

SRV RR _ldap._tcp.example.com. resolves to

0 10 636 ldap.example.org.

and your TLS server cert contains DNS-based subjectAltName or CN in 
subject DN:

ldap.example.org

Now where's the cryptograpic binding between your uri-parameter (the 
a-priori knowledge) and the name in the TLS server cert?

Like it or not the SRV lookup is only secure if you have DNSSEC and 
nslcd insists on using a local validating DNS resolver.

Ciao, Michael.