Ok lads, many thanks for the explanation.
Maybe it should be then switched off by default then? Or at least make it off in the new forthcoming AD configuration template?
What do you think?
Thanks,

Ondrej

On 08/02/2012 04:11 PM, Stephen Gallagher wrote:
On Thu, 2012-08-02 at 16:06 +0200, Ondrej Valousek wrote:
Yes, that was it, many thanks!
BTW: Is this a flaw in sssd or is it a known problem?
It's partly a flaw in AD and partly a flaw in SSSD using OpenLDAP for
referral chasing.

Active Directory does many completely-unnecessary referrals to the
global catalog, and if the randomly-selected server for that referral
isn't up, openldap's referral chasing breaks on it.

In many AD environments, referral chasing is unnecessary anyway, since
most environments perform total replication. In environments with
partial replication, it gets a little trickier.

Somewhere down the line, SSSD will reimplement referral-chasing on its
own to be more reliable, but it's a sizeable effort (and one I've
started and had to set aside twice already because of the effort
involved).


_______________________________________________
sssd-users mailing list
sssd-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-users