URL: https://github.com/SSSD/sssd/pull/854 Title: #854: LDAP: Do not require START_TLS for loopback connections
scabrero commented: """ @simo5, as you said the idea is to avoid having to set up certificates (or undocumented options) when sssd and ldap run in the same machine. I understand the potential security issues you pointed out, so would it be acceptable after adding these additional restrictions to sdap_is_loopback_address?
+ Restrict to INADDR_LOOPBACK instead the whole IN_LOOPBACKNET + Restrict to ports below 1024
IMHO it is less secure to rely on that hidden option that allows everything than the proposed changes after we agree the full list of "restrictions".
I will write a more extensive commit message if you are OK with the changes :) """
See the full comment at https://github.com/SSSD/sssd/pull/854#issuecomment-515010382