the attached patches are a short-term fix until subdomains can be
configured separately in the config file. They add a new option
subdomain_inherit and make it possible to inherit three options we
learned our users care about for subdomains - ignore_group_members,
ldap_purge_cache_timeout and ldap_use_tokengroups.
To set up a Vagrant development environment:
* Install the Vagrant packages for your development system
* On Fedora 22 and later: 'dnf install vagrant-libvirt'
* Deploy the Vagrant box:
* 'vagrant up'
* Build SSSD:
* vagrant ssh -c "cd /vagrant; reconfig; chmake"
Vagrant can keep your development tree in-sync with the Vagrant box
by running 'vagrant rsync-auto' in a shell (this will continue to
run, monitoring for changes and syncing them as they are saved).
Alternately, it can be manually synced with 'vagrant rsync' at will.
I came across this issue while testing one of Jakub's patches. You can
reproduce this e.g. with the AD provider when joined to a AD forest with
multiple domains. Now calling 'id -G' for a user from a sub-domain will
first not show all groups only after a second call of 'id -G'. In the
domain log object-not-found error messages can be found.
attached patch fixes a crash if return code of proxy_child is not 0.
You can reproduce it with sssd in non-root mode or
you can replace proxy_child with bash script.
I'm not sure about the name of tevent_immediate callback
so feel free to propose better name.
I found out that the IPA provider segfaults when it receives an
enumeration request. The first patch gets rid of the segfault, but there
would still be an error in the IPA provider is it would expect the
be_req contents to be usable for cache search. The second patch
shortcuts the enumeration request completely.
I even wonder if it was possible to shortcut the enumeration requests
sooner in the Data Provider and avoid sending them to the back ends
completely? Any downsides to this (except a possible 3rd party backend
that might allow an enumeration request on demand) ?
Finally, enumeration with IPA backend and ID views don't work at all,
but I wouldn't waste time with this at the moment -- just make sure that
we don't reqress.