Hi,
with this patch missing user and groups from trusted domains are not
handled as error anymore but just as unresolvable objects. Please note
that older versions of the IPA extdom plugin did not return
LDAP_NO_SUCH_OBJECT in all cases so this detection only work reliable
with IPA trees which already contain a patch called 'extdom: return
LDAP_NO_SUCH_OBJECT to the client'.
The second patch is just a pre-caution. Currently we unconditionally
dereference retdata if the server returns LDAP_SUCCESS. If for some
reasons the server does not send data in this case SSSD segfaults. This
patch should prevent this. Currently there is no way to test this other
than modifying the server code.
bye,
Sumit