ITS#6711 use idassert TLS conf for priv connection if aclbind not set

diff --git a/servers/slapd/back-ldap/bind.c b/servers/slapd/back-ldap/bind.c
index 42e95049256eb132207a74b61fdf1010a35cc41a..c67152b7f73dff77cd2f32f2425776eabc275606 100644 (file)
--- a/servers/slapd/back-ldap/bind.c
+++ b/servers/slapd/back-ldap/bind.c
@@ -710,7 +710,12 @@ ldap_back_prepare_conn( ldapconn_t *lc, Operation *op, SlapReply *rs, ldap_back_
 
 #ifdef HAVE_TLS
        if ( LDAP_BACK_CONN_ISPRIV( lc ) ) {
-               sb = &li->li_acl;
+               /* See "rationale:" comment in ldap_back_getconn() */
+               if ( BER_BVISNULL( &li->li_acl_authcDN ) &&
+                       !BER_BVISNULL( &li->li_idassert_authcDN ) )
+                       sb = &li->li_idassert.si_bc;
+               else
+                       sb = &li->li_acl;
 
        } else if ( LDAP_BACK_CONN_ISIDASSERT( lc ) ) {
                sb = &li->li_idassert.si_bc;