On Fri, Mar 13, 2015 at 02:36:25PM +0100, Jakub Hrozek wrote:
On Mon, Mar 09, 2015 at 10:40:52AM +0100, Sumit Bose wrote:
> Hi,
>
> with this patch missing user and groups from trusted domains are not
> handled as error anymore but just as unresolvable objects. Please note
> that older versions of the IPA extdom plugin did not return
> LDAP_NO_SUCH_OBJECT in all cases so this detection only work reliable
> with IPA trees which already contain a patch called 'extdom: return
> LDAP_NO_SUCH_OBJECT to the client'.
I tested with today's freeipa git master plus some other extdom patches
pending review.
Before the patches I got:
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result:
No such object(32), (null).
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed,
server logs might contain more details.
[sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
[sssd[be[ipa.example.com]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request
failed: 1432158222
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3
errno: 1432158222 error message: Account info lookup failed
[sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data
Provider
After applying the patches I see:
[sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result:
No such object(32), (null).
[sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
[sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0
errno: 0 error message: Success (Success)
The most crucial part is that NSS responder no longer treats the missing
object as a failure.
* master:
* 7ee9ac32485483beece872d6fcb3096fa77a004b
* 3e9712c2fdbba8f9cd25886943331e76e0b2cedd
* sssd-1-12:
* 052e37d891612ea4637c6de99cc4982383d65947
* 8d13b13f8f5bbcdac7161d55d60cb5eedaccd95c
Sorry there is no CI link, but rawhide seems to be taking ages. Other
releases already passed, so went ahead and pushed the patches.