ACKHi, with the current SSSD code, an LDAP search that results in a referral fails completely with EIO and usually sends the whole backend to offline mode. I think this is too strict and if the admin chose to ignore referrals, we should just skip these results. John Hodrien in particular was hit by us treating referrals as fatal in environment where he needs to restrict the search scope by using custom LDAP search bases. Also, in cases where Global Catalog support is disabled or GC not available and a group contains a user from a trusted domain, trying to search for this DN yields a referral. Attached is a patch that ignores referrals when the admin set ldap_referrals=false in the config file. Given the sdap async code is quite old and I don't remember all the use-cases, I CC-ed Stephen directly to get some advice. Is there any risk in ignoring referrals?
_______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/sssd-devel