On (20/01/14 17:00), Jakub Hrozek wrote:
On Mon, Jan 20, 2014 at 04:34:49PM +0100, Lukas Slebodnik wrote:
> On (20/01/14 16:25), Jakub Hrozek wrote:
> >On Mon, Jan 20, 2014 at 03:20:23PM +0100, Lukas Slebodnik wrote:
> >> On (16/01/14 21:26), Jakub Hrozek wrote:
> >> >If an optimization technique fails, this failure shouldn't abort
the
> >> >whole request, we should attempt to recover instead.
> >>
> >> >From c481990df9acc295f5883961c4783e21d443c2fc Mon Sep 17 00:00:00 2001
> >> >From: Jakub Hrozek <jhrozek(a)redhat.com>
> >> >Date: Thu, 16 Jan 2014 20:49:15 +0100
> >> >Subject: [PATCH] AD: Don't fail the request if
ad_account_can_shortcut fails
> >> >
> >> >---
> >> > src/providers/ad/ad_id.c | 3 ++-
> >> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >> >
> >> >diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c
> >> >index
0a2afda58ac17fcd644a9a49a9188383663c009f..4403969901d8ef0eafe3c5e7a94ee95379df4a4a 100644
> >> >--- a/src/providers/ad/ad_id.c
> >> >+++ b/src/providers/ad/ad_id.c
> >> >@@ -320,7 +320,8 @@ ad_account_info_handler(struct be_req *be_req)
> >> > ar->filter_type,
ar->filter_value,
> >> > ar->domain, &shortcut);
> >> > if (ret != EOK) {
> >> >- goto fail;
> >> >+ DEBUG(SSSDBG_MINOR_FAILURE, ("Cannot determine the right
domain\n"));
> >> >+ shortcut = false;
> >> > }
> >> >
> >> > if (shortcut) {
> >> >--
> >> >1.8.4.2
> >> >
> >>
> >> Patch fixes problem with handling error code from function
> >> ad_account_can_shortcut, but debug message can be confusing.
> >> Function ad_account_can_shortcut can return ERR_DOMAIN_NOT_FOUND, EIO,
> >> ERANGE(from strtouint32). It would be better to be more verbose.
> >
> >So would you like strerror (or rather sss_strerror) to be used?
> >
> In this case sss_strerror due to ERR_DOMAIN_NOT_FOUND
Right, done.
>
> >>
> >> Does SSSDBG_MINOR_FAILURE need to be used? We can recover without any
problem.
> >> In my opinion, it would be better to use different level.
> >>
> >
> >I don't have a strong opinion on this, I used MINOR_FAILURE because
> >well, it's a recoverable failure :-)
>
> I don't have a strong opinion about this :-)
I used a higher level because I remembered that in Kaushik's case the
user in question was a legitimate local user like nobody of nfsnobody.
From 05ce4ed7c8adbfac755d323902c5678f445bd7be Mon Sep 17 00:00:00
2001
From: Jakub Hrozek <jhrozek(a)redhat.com>
Date: Thu, 16 Jan 2014 20:49:15 +0100
Subject: [PATCH] AD: Don't fail the request if ad_account_can_shortcut fails
ACK
LS