Re: TLS context

[Michael <mi...@st...>]

Jacek Konieczny wrote:
> 
> On Sun, Nov 11, 2001 at 08:26:57PM +1000, David Leonard wrote:
> > Can you give an example of what a python program might look like
> > using these?
> 
> The only thing I implemented and tested now is the ldap.initialize().

This whole stuff including your Python examples looks reasonable to
me.

> You can use ldap.init() instead of ldap.initialize(). ldap.open()
> should not be used as it is depreciated, and it won't work for LDAP over
> SSL (as connection would be open before tls options are set).

Keep the name ldap.initialize(). That makes it easy to find it in
ldap.h. BTW: Support for ldapi:// (local domain socket) should be
possible with this either.

I'd also appreciate if you could manage to use ldap_r and wrap it in
such a way that python-ldap is re-entrant. Do you think that's
feasible? My module ldapthreadlock is just a weird work-around with
some serious deficiencies.

> I have not yet checked if TLS options all global or connection-specific.

I would assume that TLS/SSL options are connection-specific since
you might have different trusted root CA certs, etc.

Does the OpenLDAP API expose a call-back interface to implement CRL
checking and such?

Ciao, Michael.