On Mon, Mar 09, 2015 at 10:40:52AM +0100, Sumit Bose wrote:
Hi,
with this patch missing user and groups from trusted domains are not
handled as error anymore but just as unresolvable objects. Please note
that older versions of the IPA extdom plugin did not return
LDAP_NO_SUCH_OBJECT in all cases so this detection only work reliable
with IPA trees which already contain a patch called 'extdom: return
LDAP_NO_SUCH_OBJECT to the client'.
I tested with today's freeipa git master plus some other extdom patches
pending review.
Before the patches I got:
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result:
No such object(32), (null).
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed,
server logs might contain more details.
[sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
[sssd[be[ipa.example.com]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request
failed: 1432158222
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3
errno: 1432158222 error message: Account info lookup failed
[sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data
Provider
After applying the patches I see:
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result:
No such object(32), (null).
[sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0
errno: 0 error message: Success (Success)
The most crucial part is that NSS responder no longer treats the missing
object as a failure.