https://bugs.openldap.org/show_bug.cgi?id=9326
Issue ID: 9326 Summary: Expose LDAP_OPT_X_TLS_NEWCTX on process signal Product: OpenLDAP Version: 2.5 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: --- Component: slapd Assignee: bugs@openldap.org Reporter: dar@xoe.solutions Target Milestone: ---
After a process manager taking note of a certificate roll over, it will be convenient for such process manager to instruct the slapd daemon to set LDAP_OPT_X_TLS_NEWCTX for both client(s) and server(s) tls context through an IPC signal.
Thereby servers would gain graceful support with minimal downtime for certificate rolling.
Alternatively, dn=config _can_ be put in a shape so as to receive a dummy operation that induces a config reload.
While this is possible, it is inconvenient for several reasons:
1. It requires a _dummy_ op, and thereby has the notion of a workaround 2. It triggers a reload of the entire config, instead of only renewing the tls context (educated guess on my side) 3. It requires the process manager to somehow gain directly or indirectly knowledge of the ldap protocol. This increases deployment complexity. 4. It requires special handling of authC and authZ for such process manager and thereby significantly increases deployment complexity - especially authZ in the context of immutable / gitops-controlled configs. 5. Those dummy operations have to be crafted against olcGlobal for the server and any database's olcSyncRepl configuration. Therefore a helper must also read given values and dummy-replace them back in.