On Mon, Jan 20, 2014 at 04:34:49PM +0100, Lukas Slebodnik wrote:
On (20/01/14 16:25), Jakub Hrozek wrote:
>On Mon, Jan 20, 2014 at 03:20:23PM +0100, Lukas Slebodnik wrote:
>> On (16/01/14 21:26), Jakub Hrozek wrote:
>> >If an optimization technique fails, this failure shouldn't abort the
>> >whole request, we should attempt to recover instead.
>>
>> >From c481990df9acc295f5883961c4783e21d443c2fc Mon Sep 17 00:00:00 2001
>> >From: Jakub Hrozek <jhrozek(a)redhat.com>
>> >Date: Thu, 16 Jan 2014 20:49:15 +0100
>> >Subject: [PATCH] AD: Don't fail the request if ad_account_can_shortcut
fails
>> >
>> >---
>> > src/providers/ad/ad_id.c | 3 ++-
>> > 1 file changed, 2 insertions(+), 1 deletion(-)
>> >
>> >diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c
>> >index
0a2afda58ac17fcd644a9a49a9188383663c009f..4403969901d8ef0eafe3c5e7a94ee95379df4a4a 100644
>> >--- a/src/providers/ad/ad_id.c
>> >+++ b/src/providers/ad/ad_id.c
>> >@@ -320,7 +320,8 @@ ad_account_info_handler(struct be_req *be_req)
>> > ar->filter_type, ar->filter_value,
>> > ar->domain, &shortcut);
>> > if (ret != EOK) {
>> >- goto fail;
>> >+ DEBUG(SSSDBG_MINOR_FAILURE, ("Cannot determine the right
domain\n"));
>> >+ shortcut = false;
>> > }
>> >
>> > if (shortcut) {
>> >--
>> >1.8.4.2
>> >
>>
>> Patch fixes problem with handling error code from function
>> ad_account_can_shortcut, but debug message can be confusing.
>> Function ad_account_can_shortcut can return ERR_DOMAIN_NOT_FOUND, EIO,
>> ERANGE(from strtouint32). It would be better to be more verbose.
>
>So would you like strerror (or rather sss_strerror) to be used?
>
In this case sss_strerror due to ERR_DOMAIN_NOT_FOUND
Right, done.
>>
>> Does SSSDBG_MINOR_FAILURE need to be used? We can recover without any problem.
>> In my opinion, it would be better to use different level.
>>
>
>I don't have a strong opinion on this, I used MINOR_FAILURE because
>well, it's a recoverable failure :-)
I don't have a strong opinion about this :-)
I used a higher level because I remembered that in Kaushik's case the
user in question was a legitimate local user like nobody of nfsnobody.