On Fri, Mar 13, 2015 at 04:03:40PM +0100, Jakub Hrozek wrote:
On Fri, Mar 13, 2015 at 02:36:25PM +0100, Jakub Hrozek wrote:
> On Mon, Mar 09, 2015 at 10:40:52AM +0100, Sumit Bose wrote:
> > Hi,
> >
> > with this patch missing user and groups from trusted domains are not
> > handled as error anymore but just as unresolvable objects. Please note
> > that older versions of the IPA extdom plugin did not return
> > LDAP_NO_SUCH_OBJECT in all cases so this detection only work reliable
> > with IPA trees which already contain a patch called 'extdom: return
> > LDAP_NO_SUCH_OBJECT to the client'.
>
> I tested with today's freeipa git master plus some other extdom patches
> pending review.
>
> Before the patches I got:
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation
result: No such object(32), (null).
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation
failed, server logs might contain more details.
> [sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request
failed.
> [sssd[be[ipa.example.com]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct
request failed: 1432158222
> [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
code: 3 errno: 1432158222 error message: Account info lookup failed
> [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from
Data Provider
>
> After applying the patches I see:
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation
result: No such object(32), (null).
> [sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request
failed.
> [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error
code: 0 errno: 0 error message: Success (Success)
>
> The most crucial part is that NSS responder no longer treats the missing
> object as a failure.
* master:
* 7ee9ac32485483beece872d6fcb3096fa77a004b
* 3e9712c2fdbba8f9cd25886943331e76e0b2cedd
* sssd-1-12:
* 052e37d891612ea4637c6de99cc4982383d65947
* 8d13b13f8f5bbcdac7161d55d60cb5eedaccd95c
Sorry there is no CI link, but rawhide seems to be taking ages. Other
releases already passed, so went ahead and pushed the patches.
here it is -
http://sssd-ci.duckdns.org/logs/job/10/88/summary.html