Hi,
the attached patches implement https://fedorahosted.org/sssd/ticket/2637
There are two main use-cases: 1) If AD DCs are not reachable on the IPA server itself, we should avoid going offline completely, at least the IPA domain should be still reachable. 2) If SSSD is connected to a non-root AD DC, we still try to contact the forest root because only the forest root normally knows all the subdomains. But in many setups, the forest root is not reachable due to network restrictions.
The full design is described here: https://fedorahosted.org/sssd/wiki/DesignDocs/OneWayTrusts#Subdomainofflines...
There is one area that I'm not sure about myself -- in the ad_subdomains.c changes, I always set ignore_mark_offline to true for the root DC. I think it's safe because in this case the root domain is a subdomain and we don't want a subdomain to allow marking the be as offline, but I would like to ask that this change is double-checked.
I mostly checked by pausing AD DC VMs in my test setups and making sure that the backend stays offline after lookup error, a subsequent lookup is answered as if we were online on the backend side and that the inactive status is reset. Also, main domain failures still must mark sssd as offline.