Hello all,
I was able to reproduce a customer issue with IPA - AD trust external
memberships group processing caused by replication conflicts, in this
case it is related to a permission that is tied to the IDM trust group
through RBAC(sorry, I have not raised a ticket for it just yet). This
issue is evident in the logs here:
[add_ad_user_to_cached_groups] (0x4000): Group
[cn=custompermission+nsuniqueid=92931c98-d84011e6-9a0896c1-71a1e36a,cn=permissions,cn=pbac,dc=jstephen,dc=local]
not in the cache.
<snip>
[ipa_add_ad_memberships_get_next] (0x0040): Invalid group DN
[cn=custompermission+nsuniqueid=92931c98-d84011e6-9a0896c1-71a1e36a,cn=permissions,cn=pbac,dc=jstephen,dc=local].
[ipa_add_ad_memberships_done] (0x0040): ipa_add_ad_memberships request
failed.
It is clear the problem occurs here
val = ldb_dn_get_rdn_val(group_dn);
if (val == NULL || val->data == NULL) {
DEBUG(SSSDBG_OP_FAILURE,
"Invalid group DN [%s].\n", state->groups[state->iter]);
ret = EINVAL;
goto fail;
}
I was looking at writing a patch which skips this group instead of
failing the operation, though perhaps this is not the best method to
solve this issue.
I see that ipa_add_ad_memberships_get_next() sets a callback to
ipa_add_ad_memberships_get_group_done() which then calls
ipa_add_ad_memberships_get_next() again for the next group to be
processed. I tried the following patch based on this, but it does not
work and causes a major failure which results in SSSD restarting the
backend entirely:
diff --git a/src/providers/ipa/ipa_subdomains_ext_groups.c
b/src/providers/ipa/ipa_subdomains_ext_groups.c
index 90460bc..1e2e0c2 100644
--- a/src/providers/ipa/ipa_subdomains_ext_groups.c
+++ b/src/providers/ipa/ipa_subdomains_ext_groups.c
@@ -867,9 +867,9 @@ static void ipa_add_ad_memberships_get_next(struct
tevent_req *req)
val = ldb_dn_get_rdn_val(group_dn);
if (val == NULL || val->data == NULL) {
DEBUG(SSSDBG_OP_FAILURE,
- "Invalid group DN [%s].\n", state->groups[state->iter]);
- ret = EINVAL;
- goto fail;
+ "Invalid group DN [%s]. Skipping\n",
state->groups[state->iter]);
+ state->iter++;
+ ipa_add_ad_memberships_get_next(req);
}
fq_name = (const char *) val->data;
I suspect I am missing something obvious with the tevent flow occurring
here, I was hoping for some guidance on this.
Kind regards,
Justin Stephenson
Show replies by thread