-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/20/2014 09:20 AM, Jakub Hrozek wrote:
Hi,
with the current SSSD code, an LDAP search that results in a
referral fails completely with EIO and usually sends the whole
backend to offline mode. I think this is too strict and if the
admin chose to ignore referrals, we should just skip these
results.
John Hodrien in particular was hit by us treating referrals as
fatal in environment where he needs to restrict the search scope by
using custom LDAP search bases.
Also, in cases where Global Catalog support is disabled or GC not
available and a group contains a user from a trusted domain, trying
to search for this DN yields a referral.
Attached is a patch that ignores referrals when the admin set
ldap_referrals=false in the config file.
Given the sdap async code is quite old and I don't remember all
the use-cases, I CC-ed Stephen directly to get some advice. Is
there any risk in ignoring referrals?
I'd say this has likely always been a bug, not intentional behavior.
Go ahead and ignore the referrals.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlP3fV0ACgkQeiVVYja6o6Pc1wCgiVzMK186UfhW5xn6yVQZB704
5/gAnA521g0vMc7ZDNcKKi/I55MSLrdy
=Hlxt
-----END PGP SIGNATURE-----