[SSSD] [PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true

Sumit Bose sbose at redhat.com
Mon Nov 5 17:16:38 UTC 2012


On Mon, Nov 05, 2012 at 05:54:10PM +0100, Pavel Březina wrote:
> I found this bug when setting my own trust environment.
> 
> I was unable to match username at subdomain to subdomain. This patch
> puts me a step forward. I can match the subdomain now, but I can't
> get account info:
> 
> [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_send] (0x0400):
> Executing extended operation
> [sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_get_generic_ext_step] (0x0400):
> calling ldap_search_ext with
> [objectclass=ipaNTTrustedDomain][cn=trusts,dc=*].
> [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_done] (0x0400):
> ldap_extended_operation result: Operations error(1), (null)
> [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_get_user_done] (0x0040): s2n
> exop request failed.
> [sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_id_op_done] (0x0200):
> communication error on cached connection, moving to next server
> [sssd[nss]] [nss_cmd_getpwnam_dp_callback] (0x0040): Unable to get
> information from Data Provider

I think the issue in sss_dp_get_domains_send() should be better fixed by

diff --git a/src/responder/common/responder_get_domains.c
b/src/responder/common/responder_get_domains.c
index f4bcbf1..468dd76 100644
--- a/src/responder/common/responder_get_domains.c
+++ b/src/responder/common/responder_get_domains.c
@@ -203,7 +203,8 @@ struct tevent_req
*sss_dp_get_domains_send(TALLOC_CTX *mem_ctx,
 
     subreq = get_subdomains_send(req, rctx, state->dom,
                                  state->force, state->hint);
-    if (ret != EAGAIN) {
+    if (subreq == NULL) {
+        ret = ENOMEM;
         goto immediately;
     }
     tevent_req_set_callback(subreq, sss_dp_get_domains_process, req);

Can you check if this works for you as well?

About the exop error. This is typically an indication that winbind is
not working properly on the server. Please check your DNS configuration
and test if 'wbinfo -u' returns a list of Windows users.

bye,
Sumit

> From 72881c9dcfe7fd1c5e107af84c5be997eff5a78c Mon Sep 17 00:00:00 2001
> From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <pbrezina at redhat.com>
> Date: Mon, 5 Nov 2012 15:00:10 +0100
> Subject: [PATCH 1/2] sss_dp_get_domains_send(): set ret to EAGAIN if force is
>  true
> 
> If force is true, ret may stay uninitialized and if ret == 0
> after the subrequest is send, we will go to immediate label.
> Data provider request is sent, but the answer is never processed.
> This prohibited subdomain from working correctly.
> ---
>  src/responder/common/responder_get_domains.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/src/responder/common/responder_get_domains.c b/src/responder/common/responder_get_domains.c
> index f4bcbf14cb4aa8aff859e6429d417851267310c0..f9851b00b8d9e0aa4be5f63f993b96ded2b1e77d 100644
> --- a/src/responder/common/responder_get_domains.c
> +++ b/src/responder/common/responder_get_domains.c
> @@ -165,7 +165,9 @@ struct tevent_req *sss_dp_get_domains_send(TALLOC_CTX *mem_ctx,
>          goto immediately;
>      }
>  
> -    if (!force) {
> +    if (force) {
> +        ret = EAGAIN;
> +    } else {
>          ret = check_last_request(rctx, hint);
>          if (ret == EOK) {
>              DEBUG(SSSDBG_TRACE_FUNC,
> -- 
> 1.7.11.7
> 

> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list