[SSSD] LDAP connection tracking, sharing and fail-over retry framework
Stephen Gallagher
sgallagh at redhat.com
Fri Jul 2 15:40:15 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/02/2010 11:35 AM, Eugene Indenbom wrote:
> The complete set of patches for LDAP connection framework is attached:
>
> 0001-GSSAPI-ticket-expiry-time-is-returned-from-ldap_chil.patch
> 0002-Added-an-interface-to-query-number-of-configured-and.patch
> 0003-LDAP-connection-usage-tracking-sharing-and-failover-.patch
> 0004-Add-an-interface-to-try-next-fail-over-server-after-.patch
> 0005-Use-new-LDAP-connection-framework-to-get-user-accoun.patch
> 0006-Use-new-LDAP-connection-framework-to-get-group-accou.patch
> 0007-Use-new-LDAP-connection-framework-to-get-user-accoun.patch
> 0008-Use-new-LDAP-connection-framework-for-LDAP-user-and-.patch
> 0009-Use-new-LDAP-connection-framework-in-LDAP-access-bac.patch
> 0010-Use-new-LDAP-connection-framework-in-IPA-access-back.patch
> 0011-Use-new-LDAP-connection-framework-in-IPA-dynamic-DNS.patch
> 0012-Remove-remainder-of-now-unused-global-LDAP-connectio.patch
>
> All patches except for patch #11 (dynamic DNS updates) were tested as
> follows:
>
> 1. The test target was an RPM build with all 12 patches applied
> 2. All modified LDAP queries:
> - user account info retrieval (ldap_id.c)
> - group info retrieval (ldap_id.c)
> - user groups info retrieval (ldap_id.c)
> - users and groups enumerations (ldap_id_enum.c)
> - LDAP access handler (sdap_access.c)
> - IPA access handler (ipa_access.c)
> were tested for:
> - Normal operation
> - Fail-over retry after communication failure (during LDAP request
> execution)
> - Proper error reporting after fail-over retry limit is exceeded
> - Switching to offline operation when OFFLINE state is detected
> during LDAP request execution
>
> I do not have an environment to test Dynamic DNS updates. It would be
> great if somebody could test them.
>
I'll get started testing these today. I may not get through them all
until sometime next week, though. (Monday is a holiday in the USA as well)
Thanks very much!
> I am sorry that the complete set of patches is so huge. I have done
> everything I could to make each patch as small and simple as possible.
> I would be glad to integrate any suggestions that could simplify or
> improve the result.
>
> Eugene Indenbom
>
> PS I have found a discrepancy in ONLINE and OFFLINE IPA access handling:
> when no IPA HBAC rules are defined, it is considered OK during ONLINE
> operation (PAM_PERM_DENIED is returned) but handled as PAM_SYSTEM_ERR
> during OFFLINE. Should I create a ticket for that?
>
Yes, please do. That's definitely wrong.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkwuCF8ACgkQeiVVYja6o6MkcACfXl86cPWNOdTlrTcPSJvczAuA
yUAAoILECab1VVDEc9Kbjlac0f8CN1Bl
=Odrw
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list