sorry, I do not have working AD so I did
not test the patches. My testing
was only SSSD compilation :)
But I made a small ap that parses
ini files and treats the errors
the same way as in these patches
and it worked fine.
It prints the problematic line
with short error description
(like missing equal sign).
The patch is quite simple. It does not
solve any GPO issues, just logs found
parsing errors for easier debugging.
I will work on $subject  and I have discussed this topic with Jakub a
week ago. There are some open questions, so I will be glad if you say
There could be heavy traffic between SSSD client and server coused by
local users. We need longer timeout in negative cache for local users.
a) Is better hack negative_cache or responder?
b) Is better set timeout = 0 (it means permanently in negative cache) or
set something really big like 12 hours?
* We couldn't remove local users from permanent negative cache (only by
* Is timeout = 12 hours means some kind of network peak?
c) Is it enough to do it only for initgroups?
One way to fix this would be to revert:
These patches simplified the entryUSN fitler from (&(entryUSN >=
$last)(entryUSN != $last)) to (entryUSN >= $last + 1). This was
requested by Thierry to improve filter-evaluation performance so I
choose to keep this filter and move the incremental logic into parsing
function, appending "Z" or whatever we string remains to the new value
in case of modifyTimestamp attribute.