opscode/opscode-omnibus — pull request #619 by marcparadise (2014-11-20 04:23:47+00:00)
Title: make ldap config sane and don't break cs11 compatibility

WIP - testing still in progress.

ping @opscode/server-team

So @kwilczynski and I discussed this a bit and concluded that the removal of `enable_ssl` broke backwards compatibility with ldap configuration under EC11. In addition, it's kind of confusing - the term `simple_tls` is not a meaningful one, but we used it to indicate ssl suppor. (This was a holdover from net/ldap we used in opscode-account, which apparently dubbed ssl 'simple-tls'). Further, we accepted a value of 'start_tls', but research so far shows that we ignored it if specified (further verification needed, but I do not *think* net/ldap supported this).

This change tries to simplify things:
* deprecates the 'encryption' setting - since we're only ever using two values, having a freeform type makes no sense.
* reinstate enable_ssl. It will now work as it used to: if you specify it in configuration, we will make an SSL connection to the ldap host from oc_erchef.
* add enable_tls. If specified, we will upgrade to a secure connection via the STARTTLS command after establishing the connection to the ldap server
* if enable_ssl is set, use standard default ssl port if port is not configured
* permit 'encryption' values of 'start_tls' and 'simple_tls', but warn that they are deprecated
* fail if we see an unknown `encryption` value; or if both `enable_ssl` and `enable_tls` are specified (they are mutually exclusive).

Another commit will be made to add changelog and release notes entries.

/cc @jamescott for incoming documentation and release notes changes