[SSSD] [PATCH] LDAP: If deref search fails, try again without deref

Stephen Gallagher sgallagh at redhat.com
Wed Dec 5 13:50:50 UTC 2012


On Wed 05 Dec 2012 04:54:52 AM EST, Jan Cholasta wrote:
> On 3.12.2012 21:36, Stephen Gallagher wrote:
>> On Mon 03 Dec 2012 11:14:28 AM EST, Jan Cholasta wrote:
>>> Hi,
>>>
>>> the attached patch fixes <https://fedorahosted.org/sssd/ticket/1660>.
>>
>>
>>
>> Could we do this as a check during the RootDSE lookup (similar to how we
>> test for the Active Directory matching rule support) instead of doing so
>> when we attempt a deref lookup? It would more consistently report the
>> issue during startup as well.
>
> Sure, but can we really trust this check? AFAICT in OpenLDAP deref is
> configured per naming context, which means it might not be available
> in RootDSE, even when it is available in our search base.
>
> Honza
>

I think you misunderstood my recommendation. I didn't mean that you 
should do this check against the RootDSE itself, but instead to do it 
during the process we use for getting the RootDSE in the first place. 
It's intent is to determine the capabilities of the system.

What I meant was to test each of the configured search bases at this 
point once right at the time of connection so that if there are issues 
we will be able to report them early on, instead of waiting for the 
first time a search occurs on each base.



More information about the sssd-devel mailing list