On Wed 05 Dec 2012 04:54:52 AM EST, Jan Cholasta wrote:
On 3.12.2012 21:36, Stephen Gallagher wrote:
> On Mon 03 Dec 2012 11:14:28 AM EST, Jan Cholasta wrote:
>> Hi,
>>
>> the attached patch fixes <
https://fedorahosted.org/sssd/ticket/1660>.
>
>
>
> Could we do this as a check during the RootDSE lookup (similar to how we
> test for the Active Directory matching rule support) instead of doing so
> when we attempt a deref lookup? It would more consistently report the
> issue during startup as well.
Sure, but can we really trust this check? AFAICT in OpenLDAP deref is
configured per naming context, which means it might not be available
in RootDSE, even when it is available in our search base.
Honza
I think you misunderstood my recommendation. I didn't mean that you
should do this check against the RootDSE itself, but instead to do it
during the process we use for getting the RootDSE in the first place.
It's intent is to determine the capabilities of the system.
What I meant was to test each of the configured search bases at this
point once right at the time of connection so that if there are issues
we will be able to report them early on, instead of waiting for the
first time a search occurs on each base.