[SSSD] [PATCH] Ignore referrals when ldap_referrals=false
Stephen Gallagher
sgallagh at redhat.com
Fri Aug 22 17:26:53 UTC 2014
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/20/2014 09:20 AM, Jakub Hrozek wrote:
> Hi,
>
> with the current SSSD code, an LDAP search that results in a
> referral fails completely with EIO and usually sends the whole
> backend to offline mode. I think this is too strict and if the
> admin chose to ignore referrals, we should just skip these
> results.
>
> John Hodrien in particular was hit by us treating referrals as
> fatal in environment where he needs to restrict the search scope by
> using custom LDAP search bases.
>
> Also, in cases where Global Catalog support is disabled or GC not
> available and a group contains a user from a trusted domain, trying
> to search for this DN yields a referral.
>
> Attached is a patch that ignores referrals when the admin set
> ldap_referrals=false in the config file.
>
> Given the sdap async code is quite old and I don't remember all
> the use-cases, I CC-ed Stephen directly to get some advice. Is
> there any risk in ignoring referrals?
>
I'd say this has likely always been a bug, not intentional behavior.
Go ahead and ignore the referrals.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iEYEARECAAYFAlP3fV0ACgkQeiVVYja6o6Pc1wCgiVzMK186UfhW5xn6yVQZB704
5/gAnA521g0vMc7ZDNcKKi/I55MSLrdy
=Hlxt
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list