In violation of the standard, some LDAP servers control access to
the RootDSE, thus preventing us from being able to read it before
performing a bind.
This patch will allow us to continue on if the RootDSE was
inaccessible. All of the places that we use the return value of
the RootDSE after this are already checked for NULL and use sane
defaults if the RootDSE is unavailable.
I was poking around related code today and realized that the fix for
this was actually very easy (as at present we are only using the result
of the rootDSE lookup to determine if we can perform a GSSAPI bind, but
it's already covered to just skip the check and assume that the server
is capable if the rootDSE object is empty.
There is one other place, in sdap_initgr_nested_send() where we have a
TODO in place to use the rootDSE to detect deref and ASQ support, but we
are not actually doing so yet anyway.
I think this will solve
https://fedorahosted.org/sssd/ticket/497 easily,
and I think it's worth re-targeting to 1.2.2. This patch applies to both
master and sssd-1-2.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/