URL:
https://github.com/SSSD/sssd/pull/470
Author: jhrozek
Title: #470: IPA: Enable periodic subdomains refresh only after responder-induced refresh
finishes
Action: opened
PR body:
"""
Resolves:
https://pagure.io/SSSD/sssd/issue/3601
When the IPA subdomains code is initialized, the responders send a request
to fetch subdomains. This request first stores the list of trusted domains
to the cache and then runs the ipa-getkeytab helper.
At the same time, the periodical task to update the subdomains is also
started. The task founds out that all the trusted domains are already known
and finishes the request, which replies to the Data Provider requests as
well even while the ipa-getkeytab request is still running.
This unblocks requests from the responders, which try to connect to the AD
DCs even before the keytab is available, which switches the SSSD status to
offline.
The fix in this PR is only one of the alternatives. I wonder if it's OK
to rely on the responders to enable the ptask, especially in cases where
all the responders might be socket-activated, so none might be running
on SSSD startup. In this case, we might want to enable the ptask later,
with a delay. On the other hand, this way makes sure that at least one
request from the responder runs to full completion, otherwise we still
might run into the reverse race when the responder request comes into
the middle of the delayed ptask..
In both cases, I think we shouldn't also call the full handler from the
ptask, because the ptask shouldn't ever call the DP reply functions. Instead,
we should split the handler into an internal request and a wrapper around
it that also replies to DP. The ptask should just call the internal request
without replying to anything.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/470/head:pr470
git checkout pr470