[SSSD] [PATCH] AD: Don't fail the request if ad_account_can_shortcut fails

Jakub Hrozek jhrozek at redhat.com
Mon Jan 20 16:00:32 UTC 2014


On Mon, Jan 20, 2014 at 04:34:49PM +0100, Lukas Slebodnik wrote:
> On (20/01/14 16:25), Jakub Hrozek wrote:
> >On Mon, Jan 20, 2014 at 03:20:23PM +0100, Lukas Slebodnik wrote:
> >> On (16/01/14 21:26), Jakub Hrozek wrote:
> >> >If an optimization technique fails, this failure shouldn't abort the
> >> >whole request, we should attempt to recover instead.
> >> 
> >> >From c481990df9acc295f5883961c4783e21d443c2fc Mon Sep 17 00:00:00 2001
> >> >From: Jakub Hrozek <jhrozek at redhat.com>
> >> >Date: Thu, 16 Jan 2014 20:49:15 +0100
> >> >Subject: [PATCH] AD: Don't fail the request if ad_account_can_shortcut fails
> >> >
> >> >---
> >> > src/providers/ad/ad_id.c | 3 ++-
> >> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >> >
> >> >diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c
> >> >index 0a2afda58ac17fcd644a9a49a9188383663c009f..4403969901d8ef0eafe3c5e7a94ee95379df4a4a 100644
> >> >--- a/src/providers/ad/ad_id.c
> >> >+++ b/src/providers/ad/ad_id.c
> >> >@@ -320,7 +320,8 @@ ad_account_info_handler(struct be_req *be_req)
> >> >                                   ar->filter_type, ar->filter_value,
> >> >                                   ar->domain, &shortcut);
> >> >     if (ret != EOK) {
> >> >-        goto fail;
> >> >+        DEBUG(SSSDBG_MINOR_FAILURE, ("Cannot determine the right domain\n"));
> >> >+        shortcut = false;
> >> >     }
> >> > 
> >> >     if (shortcut) {
> >> >-- 
> >> >1.8.4.2
> >> >
> >> 
> >> Patch fixes problem with handling error code from function
> >> ad_account_can_shortcut, but debug message can be confusing.
> >> Function ad_account_can_shortcut can return ERR_DOMAIN_NOT_FOUND, EIO,
> >> ERANGE(from strtouint32). It would be better to be more verbose.
> >
> >So would you like strerror (or rather sss_strerror) to be used?
> >
> In this case sss_strerror due to ERR_DOMAIN_NOT_FOUND

Right, done.

> 
> >> 
> >> Does SSSDBG_MINOR_FAILURE need to be used? We can recover without any problem.
> >> In my opinion, it would be better to use different level.
> >> 
> >
> >I don't have a strong opinion on this, I used MINOR_FAILURE because
> >well, it's a recoverable failure :-)
> 
> I don't have a strong opinion about this :-)

I used a higher level because I remembered that in Kaushik's case the
user in question was a legitimate local user like nobody of nfsnobody.
-------------- next part --------------
>From 05ce4ed7c8adbfac755d323902c5678f445bd7be Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Thu, 16 Jan 2014 20:49:15 +0100
Subject: [PATCH] AD: Don't fail the request if ad_account_can_shortcut fails

---
 src/providers/ad/ad_id.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/providers/ad/ad_id.c b/src/providers/ad/ad_id.c
index 0a2afda58ac17fcd644a9a49a9188383663c009f..3d26957b13cd39cf6e07cec5c7656910a15b9f46 100644
--- a/src/providers/ad/ad_id.c
+++ b/src/providers/ad/ad_id.c
@@ -320,7 +320,9 @@ ad_account_info_handler(struct be_req *be_req)
                                   ar->filter_type, ar->filter_value,
                                   ar->domain, &shortcut);
     if (ret != EOK) {
-        goto fail;
+        DEBUG(SSSDBG_TRACE_FUNC,
+              ("Cannot determine the right domain: %s\n", sss_strerror(ret)));
+        shortcut = false;
     }
 
     if (shortcut) {
-- 
1.8.4.2



More information about the sssd-devel mailing list