On Mon, Aug 13, 2012 at 07:27:42PM -0400, Stephen Gallagher wrote:
On Mon, 2012-08-13 at 15:03 -0400, Stephen Gallagher wrote:
> This patch backports commit 6fb75e297bf7fc83e3db1f5ae8560624656ef319 to
> the 1.5.x branch. It makes one major change: 1.5.x does not have support
> for deref/ASQ searches, so the deref lookup for hostgroups has been
> replaced by parallel LDAP "base" searches.
>
> I'm attaching two patches. One is the complete patch to backport, the
> other is just an interdiff of the changes from Jan's original patch to
> support the parallel lookups.
>
> I'm still in the process of testing this patch, but I wanted to get it
> out for review in the meantime.
Ok, during testing I found one bug where I forgot to initialize a
loop-control/array-index variable. Oops.
My basic smoketesting is now complete. Both modes (srchost enabled and
disabled) are working as expected for a small set of hosts. I don't have
the infrastructure to test large numbers, but I suspect the only
difference will be performance, not function.
New patches attached. As before, one is the complete patch ("Add
ipa_hbac_support_srchost option to IPA provider") and the other is just
the changes from Jan Zeleny's original patch (to simplify the review
process).
I don't understand this part:
+ if (queue_len == 0) {
+ /* This host is not in any hostgroups */
+ ret = ENOMEM;
+ goto error;
+ }
This seems to be preventing me from logging into a host that is not part
of any host group:
[ipa_hbac_hostgroup_info_done] (3): Error [12][Cannot allocate memory]
[sdap_id_op_done] (9): releasing operation connection
The rest looks good. Thank you for the interdiff, indeed it made the
review easier.