>>- { "ldap_group_objectsid", NULL, SYSDB_SID,
NULL },
>>+ { "ldap_group_objectsid", "objectSID", SYSDB_SID, NULL
},
>> { "ldap_group_modify_timestamp", "modifyTimestamp",
SYSDB_ORIG_MODSTAMP, NULL },
>> { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
>> { "ldap_group_type", NULL, SYSDB_GROUP_TYPE, NULL },
>These changes in rfc2307_user_map and rfc2307bis_user_map caused regression,
>which was fixed by ticket
https://fedorahosted.org/sssd/ticket/2383
>
>Dereference failed with openldapserver.
>[sdap_nested_group_process_send] (0x2000): Dereferencing members of group
[cn=topgrp,ou=Groups,dc=example,dc=com]
>[sdap_deref_search_send] (0x2000): Server supports OpenLDAP deref
>[sdap_x_deref_search_send] (0x0400): Dereferencing entry
[cn=topgrp,ou=Groups,dc=example,dc=com] using OpenLDAP deref
>[sdap_print_server] (0x2000): Searching 10.16.64.191
>[sdap_get_generic_ext_step] (0x0400): calling ldap_search_ext with [no
filter][cn=topgrp,ou=Groups,dc=example,dc=com].
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectClass]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [cn]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [userPassword]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [gidNumber]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [member]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [objectSID]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [modifyTimestamp]
>[sdap_get_generic_ext_step] (0x1000): Requesting attrs: [uid]
>[sdap_get_generic_ext_step] (0x2000): ldap_search_ext called, msgid = 3
>[sdap_process_message] (0x4000): Message type: [LDAP_RES_SEARCH_RESULT]
>[sdap_get_generic_op_finished] (0x0400): Search result: Protocol error(2),
Dereference control: attribute decoding error
>[sdap_get_generic_op_finished] (0x0040): Unexpected result from ldap: Protocol
error(2), Dereference control: attribute decoding error
>[generic_ext_search_handler] (0x0040): sdap_get_generic_ext_recv failed [5]:
Input/output error
>[sdap_deref_search_done] (0x0040): dereference processing failed [5]: Input/output
error
>[sdap_nested_group_deref_direct_done] (0x0020): Error processing direct membership
[5]: Input/output error
>[sdap_nested_done] (0x0020): Nested group processing failed: [5][Input/output error]
>
>
>SSSD did equivalen of next command line search:
>[root@host ~]# ldapsearch -x -LLL -h $SERVER -b 'dc=example,dc=com' \
> -E
'!deref=member:objectClass,cn,userPassword,gidNumber,objectSID,modifyTimestamp,uid'
\
> cn=topgrp
>Protocol error (2)
>Additional information: Dereference control: attribute decoding error
>
>Dereferencing failed because attribute objectSID isn't in any objectclass on
>openldap server.
>
>Summary:
>We should revert this patch. ObjectSID should not be set by default
>in rfc2307 or rfc2307bis scheme.
>
BTW we had the same problem with nonstandard UUID attribute
https://git.fedorahosted.org/cgit/sssd.git/commit/?id=dfb2960ab251f609466...
LS
OK, this is bad, thanks a lot for catching the problem.
I agree that we should revert the patch as a first step. But at the same
time, the changes in 1.11 caused problems for several users running with
id_provider=ldap enrolled with an AD server.
In retrospective, I wish we limited some of the AD-specific features to
the AD provider only, but in order to mitigate the problem, what about
setting the defaults if (and only if) we detect the server is an AD
server from rootDSE? We already do that for tokenGroups..