Arvados

A couple of questions:

• If StartTLS is true, the MinVersion is set only when Insecure mode is ON, is that on purpose? Wouldn't that be needed regardless of the insecure setting? I understand that using a TLS version less than 1.2 is insecure by now, but what feels confusing to me is the difference in behavior between using "ldaps://..." and StartTLS.
• Do you think it would be a good idea to make controller somewhat hint the cluster admin what is the issue and how to fix it in the logs when there's a TLS version mismatch on user login?

The rest LGTM.

• If StartTLS is true, the MinVersion is set only when Insecure mode is ON, is that on purpose?

Oops, no. Fixed.

• Do you think it would be a good idea to make controller somewhat hint the cluster admin what is the issue and how to fix it in the logs when there's a TLS version mismatch on user login?

Yes. Added the error message to config.default.yml and I suppose mentioning the actual config knob here might make this issue page more helpful when a search for the error message leads here.

        # Mininum TLS version to negotiate when connecting to server                                                                             
        # (ldaps://... or StartTLS). It may be necessary to set this                                                                             
        # to "1.1" for compatibility with older LDAP servers that fail                                                                           
        # with 'LDAP Result Code 200 "Network Error": TLS handshake                                                                              
        # failed (tls: server selected unsupported protocol version                                                                              
        # 301)'.                                                                                                                                 
        #                                                                                                                                        
        # If blank, use the recommended minimum version (1.2).                                                                                   
        MinTLSVersion: "" 

19896-ldap-tls-downgrade @ 7432df3ab18b66c2a5dac1f18c9e8b1d7a388558 -- developer-run-tests: #3445

This LGTM, thanks!