URL:
https://github.com/SSSD/sssd/pull/655
Title: #655: Invalid id provider prevents other domains to start
mzidek-rh commented:
"""
Just a small update.
We had a debug seesion with jhrozek today and the observation is following:
The reason why SSSD is terminating is because the responders are trying to connect to the
sockets of the responder that fails to initialize (so the sockets do not exist). The
responders have no way to figure out that they are trying to connect to sockets of failed
backend so they fail as well (they can not just skip the domain and hope for the best).
We were thinking about several ways to fix this issue, but they are slightly hackish.
The return code of the failed backend process could be detected and we would write special
attribute 'broken = true' to the domain section of this responder in confdb. Then
in confdb_get_domains_internal the domain with this special attribute would be skipped.
This would work not just for bad id provider but for all errors in backend
initialization.
Also as most people would hit this bug when id_provider is set to the deprecated value of
"local" we would detect this setting in the confdb_get_domain_internal, write a
loud message into the logs and skip the domain in that case (this can be done in addition
to the previous patch in order to get better debugging or separately and would cover the
most common case, it could also work on it it's own without the previous fix, but that
would only cover the id_provider local failures not all possible failures in the
backend).
We can discuss it a bit more on the devel meeting tomorrow.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/655#issuecomment-420705488