ldap.conf configuration and location for Kerberos Instance about yast-auth-server

[Firstyear]

Looking at the code, it looks like this always expects ldaps to the server, so the ldap.conf setting here that actually matters is "tls_reqcert allow": from the ldap.conf page:

              allow  The  server  certificate  is requested. If no certificate is provided, the session proceeds normally. If a bad certificate is provided, it will be ignored and the session proceeds normally.

This is actually because ldapclient is extremely bad at communicating what went wrong. Almost every failure looks like a bind failure, including a certificate verification error. Like, seriously, look at this:

# ldapwhoami -H ldaps://nonexist.ldap.com
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
# ldapwhoami -H ldaps://ad.blackhats.net.au    <-- this is a real server
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)
#  ldapwhoami -H ldaps://ad.blackhats.net.au:389  <<-- wrong port
ldap_sasl_interactive_bind_s: Can't contact LDAP server (-1)

I'm not even sure where to to start on this - the entire ecosystem of LDAP has spent years neglecting communication of clear actionable errors to clients and users, and I think this kind of thing goes so deep that it's not possible for us to resolve. This will be the ruby LDAPClient library that is reporting the status from the openldap client library here. I do not believe this is possible to fix ....