Hi,
the attached patches implement
https://fedorahosted.org/sssd/ticket/2637
There are two main use-cases:
1) If AD DCs are not reachable on the IPA server itself, we should
avoid going offline completely, at least the IPA domain should be
still reachable.
2) If SSSD is connected to a non-root AD DC, we still try to contact
the forest root because only the forest root normally knows all the
subdomains. But in many setups, the forest root is not reachable
due to network restrictions.
The full design is described here:
https://fedorahosted.org/sssd/wiki/DesignDocs/OneWayTrusts#Subdomainoffli...
There is one area that I'm not sure about myself -- in the
ad_subdomains.c changes, I always set ignore_mark_offline to true for
the root DC. I think it's safe because in this case the root domain is a
subdomain and we don't want a subdomain to allow marking the be as
offline, but I would like to ask that this change is double-checked.
I mostly checked by pausing AD DC VMs in my test setups and making sure
that the backend stays offline after lookup error, a subsequent lookup
is answered as if we were online on the backend side and that the
inactive status is reset. Also, main domain failures still must mark
sssd as offline.