[SSSD] [PATCH] Download the list of subdomains from the forest root

Lukas Slebodnik lslebodn at redhat.com
Wed Apr 2 15:20:49 UTC 2014


On (02/04/14 16:00), Jakub Hrozek wrote:
>On Wed, Apr 02, 2014 at 03:47:45PM +0200, Jakub Hrozek wrote:
>> Hi,
>> 
>> as described in https://fedorahosted.org/sssd/ticket/2285, we need to
>> download the list of trusted domains from the forest root, because only
>> the forest root knows the full list of domains. The leafs only store
>> itself and the forest root.
>> 
>> Initially, I wanted to use the Global Catalog, but it turned out not all
>> attributes we care about are present in the GC, such as the flatName. So
>> the attached patch connects directly to the LDAP port of the forest root
>> in case the SSSD is not enrolled with a forest root already.
>> 
>> There is one bit of code duplication that both callers
>> of ad_subdom_ad_ctx_new set the newly created ad_id_ctx as a pvt
>> pointer of the sdap domain on success. Initially I moved that logic
>> to ad_subdom_ad_ctx_new but later I realized that the sdom handling in
>> ad_subdom_ad_ctx_new is strange (we just read the sdom from the newly
>> created ad_id_ctx, not from the 'parent' and never use it afterwards..) and
>> I'd like to fix this properly with a follow up patch.
>> 
>> Thanks for review.
>
>I managed to attach the wrong 1.11 patch. This time, both patches should
>be fine.

>From bf85e3515fd8e70bcbdc6e8fb075ff4ff210e2da Mon Sep 17 00:00:00 2001
>From: Jakub Hrozek <jhrozek at redhat.com>
>Date: Tue, 1 Apr 2014 13:51:49 -0400
>Subject: [PATCH] AD: connect to forest root when downloading the list of
> subdomains
>
>https://fedorahosted.org/sssd/ticket/2285
>
Source code looks good to me.
I don't have such AD setup I tested only with single AD domain.
(This patch did not break anything)
Jeremy tested patch with tree domains.

ACK

LS



More information about the sssd-devel mailing list