[SSSD] [PATCH] Ignore referrals when ldap_referrals=false

Stephen Gallagher sgallagh at redhat.com
Fri Aug 22 17:26:53 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/20/2014 09:20 AM, Jakub Hrozek wrote:
> Hi,
> 
> with the current SSSD code, an LDAP search that results in a
> referral fails completely with EIO and usually sends the whole
> backend to offline mode. I think this is too strict and if the
> admin chose to ignore referrals, we should just skip these
> results.
> 
> John Hodrien in particular was hit by us treating referrals as
> fatal in environment where he needs to restrict the search scope by
> using custom LDAP search bases.
> 
> Also, in cases where Global Catalog support is disabled or GC not
> available and a group contains a user from a trusted domain, trying
> to search for this DN yields a referral.
> 
> Attached is a patch that ignores referrals when the admin set 
> ldap_referrals=false in the config file.
> 
> Given the sdap async code is quite old and I don't remember all
> the use-cases, I CC-ed Stephen directly to get some advice. Is
> there any risk in ignoring referrals?
> 

I'd say this has likely always been a bug, not intentional behavior.
Go ahead and ignore the referrals.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iEYEARECAAYFAlP3fV0ACgkQeiVVYja6o6Pc1wCgiVzMK186UfhW5xn6yVQZB704
5/gAnA521g0vMc7ZDNcKKi/I55MSLrdy
=Hlxt
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list