[SSSD] [PATCH] sss_dp_get_domains_send(): set ret to EAGAIN if force is true
Simo Sorce
simo at redhat.com
Mon Nov 5 20:18:38 UTC 2012
On Mon, 2012-11-05 at 18:16 +0100, Sumit Bose wrote:
> On Mon, Nov 05, 2012 at 05:54:10PM +0100, Pavel Březina wrote:
> > I found this bug when setting my own trust environment.
> >
> > I was unable to match username at subdomain to subdomain. This patch
> > puts me a step forward. I can match the subdomain now, but I can't
> > get account info:
> >
> > [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_send] (0x0400):
> > Executing extended operation
> > [sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_get_generic_ext_step] (0x0400):
> > calling ldap_search_ext with
> > [objectclass=ipaNTTrustedDomain][cn=trusts,dc=*].
> > [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_exop_done] (0x0400):
> > ldap_extended_operation result: Operations error(1), (null)
> > [sssd[be[IPA-SUDO-SUBDOMAIN]]] [ipa_s2n_get_user_done] (0x0040): s2n
> > exop request failed.
> > [sssd[be[IPA-SUDO-SUBDOMAIN]]] [sdap_id_op_done] (0x0200):
> > communication error on cached connection, moving to next server
> > [sssd[nss]] [nss_cmd_getpwnam_dp_callback] (0x0040): Unable to get
> > information from Data Provider
>
> I think the issue in sss_dp_get_domains_send() should be better fixed by
>
> diff --git a/src/responder/common/responder_get_domains.c
> b/src/responder/common/responder_get_domains.c
> index f4bcbf1..468dd76 100644
> --- a/src/responder/common/responder_get_domains.c
> +++ b/src/responder/common/responder_get_domains.c
> @@ -203,7 +203,8 @@ struct tevent_req
> *sss_dp_get_domains_send(TALLOC_CTX *mem_ctx,
>
> subreq = get_subdomains_send(req, rctx, state->dom,
> state->force, state->hint);
> - if (ret != EAGAIN) {
> + if (subreq == NULL) {
> + ret = ENOMEM;
> goto immediately;
> }
> tevent_req_set_callback(subreq, sss_dp_get_domains_process, req);
>
> Can you check if this works for you as well?
>
> About the exop error. This is typically an indication that winbind is
> not working properly on the server. Please check your DNS configuration
> and test if 'wbinfo -u' returns a list of Windows users.
In F17 I needed to put selinux in permissive mode at least for a while,
not sure if the latest selinux policy works ok now, in F18 it should be
fine.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list