attached is patch for ticket
The ticket also talks about allowing options
for negative cache timeouts in all responders,
but I did not do that.
We do indeed initialize negative cache in all
responders, but we always read the timeouts
from NSS section. Also in the man pages, we only
document these options for NSS. So it is not
problem with the schema. I do agree that this is
not ideal, but should we fix it? I do not
think it is worth the time, but if someone thinks
otherwise, please open a ticket.
it is possible that the CLAP/netlogon reply does not contain any site
data. In this case we should not fail but just use what we can get.
Especially when looking up the Global Catalog the forest name is needed.
If the site name is missing we still can use the forest name to lookup
the Global Catalog in DNS.
The first patch is not strictly related to the issue but since it fixes
a potential memory leak (we currently do not have it because only
short-lived memory contexts are used so far) I think it is worth adding
this patch set should fix https://fedorahosted.org/sssd/ticket/2958
"Support multiple principals for IPA users" so the IPA users can log in
with their Kerberos alias as well.
The overall code-path was already added for the UPN feature but had to
be extended at various places. The main difference is that the realm
part of the AD UPNs with an alternative domain suffix do not related to
a known domain name. The realm part from the Kerberos aliases can come
from any domain. The same is true for email addresses which are supported
by this patch set as well.
I know that Jakub had some concerns adding email addresses now and the
another attribute in the next version and so on. I would like to make
this scheme more generic so that the attributes which should be used for
login names can be configured. Unfortunately I didn't had the time do
already do it in this patch-set.
Adding a larger number of sources for the login name increases the
chance for collisions. But since each of the name types, Kerberos
principals and email addresses, are expected to be unique in their
domain, I hope the chances are still low enough.