[python-ldap] stop tls without ldap unbind

[dipti Burli]

Hi Michael,

I understand that TLS gives security and integrity.

Am using python-ldap as test scripts/code to Test the ldap server.
Its ldapServer`s requirement that it needs to respond with
ldap(add/search/modify) operations on a connection which was binded on TLS
and torn down after bind.

The Server has performance/delay issues when data gets encrypted on large
search and modify operations. Hence the query in python.

I have 2 options
1.  Create python socket, wrap it with ssl then use it to send encrypted
message or plain test message( after tearing down only TLS) on the
ssl_socket, but issue here is framing ldap messages explictly.  is there
anyway to do it?
2. Using python-ldap , wihich readily provides apis to bind ,search, and
other operations .but cant tear down TLS after bind and still use the same
association.

Any help will be much of great assitance.



On Wed, May 24, 2017 at 3:11 PM, Michael Ströder <michael at stroeder.com>
wrote:

> dipti Burli wrote:
> > According to RFC I thought it was  possible.
> >
> > Below is what am referring. by ldap association being intact when TLS is
> closed down.
> >
> > 4.  Closing a TLS Connection
>
> Yes, but there's no such thing like a StopTLS LDAP PDU.
>
> Again: Why do you want that?
>
> Note that security is also about integrity and TLS gives you integrity
> protection for the
> connection.
>
> Ciao, Michael.
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-ldap/attachments/20170524/e2d4fc62/attachment.html>