[SSSD] LDAP connection tracking, sharing and fail-over retry framework

Stephen Gallagher sgallagh at redhat.com
Fri Jul 2 15:40:15 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/02/2010 11:35 AM, Eugene Indenbom wrote:
> The complete set of patches for LDAP connection framework is attached:
> 
>     0001-GSSAPI-ticket-expiry-time-is-returned-from-ldap_chil.patch
>     0002-Added-an-interface-to-query-number-of-configured-and.patch
>     0003-LDAP-connection-usage-tracking-sharing-and-failover-.patch
>     0004-Add-an-interface-to-try-next-fail-over-server-after-.patch
>     0005-Use-new-LDAP-connection-framework-to-get-user-accoun.patch
>     0006-Use-new-LDAP-connection-framework-to-get-group-accou.patch
>     0007-Use-new-LDAP-connection-framework-to-get-user-accoun.patch
>     0008-Use-new-LDAP-connection-framework-for-LDAP-user-and-.patch
>     0009-Use-new-LDAP-connection-framework-in-LDAP-access-bac.patch
>     0010-Use-new-LDAP-connection-framework-in-IPA-access-back.patch
>     0011-Use-new-LDAP-connection-framework-in-IPA-dynamic-DNS.patch
>     0012-Remove-remainder-of-now-unused-global-LDAP-connectio.patch
> 
> All patches except for patch #11 (dynamic DNS updates) were tested as
> follows:
> 
> 1. The test target was an RPM build with all 12 patches applied
> 2. All modified LDAP queries:
>     - user account info retrieval (ldap_id.c)
>     - group info retrieval (ldap_id.c)
>     - user groups info retrieval (ldap_id.c)
>     - users and groups enumerations (ldap_id_enum.c)
>     - LDAP access handler (sdap_access.c)
>     - IPA access handler (ipa_access.c)
> were tested for:
>     - Normal operation
>     - Fail-over retry after communication failure (during LDAP request
> execution)
>     - Proper error reporting after fail-over retry limit is exceeded
>     - Switching to offline operation when OFFLINE state is detected
> during LDAP request execution
> 
> I do not have an environment to test Dynamic DNS updates. It would be
> great if somebody could test them.
> 

I'll get started testing these today. I may not get through them all
until sometime next week, though. (Monday is a holiday in the USA as well)

Thanks very much!

> I am sorry that the complete set of patches is so huge. I have done
> everything I could to make each patch as small and simple as possible.
> I would be glad to integrate any suggestions that could simplify or
> improve the result.
> 
> Eugene Indenbom
> 
> PS I have found a discrepancy in ONLINE and OFFLINE IPA access handling:
> when no IPA HBAC rules are defined, it is considered OK during ONLINE
> operation (PAM_PERM_DENIED is returned) but handled as PAM_SYSTEM_ERR
> during OFFLINE. Should I create a ticket for that?
> 

Yes, please do. That's definitely wrong.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkwuCF8ACgkQeiVVYja6o6MkcACfXl86cPWNOdTlrTcPSJvczAuA
yUAAoILECab1VVDEc9Kbjlac0f8CN1Bl
=Odrw
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list