[SSSD] [PATCH] LDAP: Don't abort request if no id mapping domain matches

Sumit Bose sbose at redhat.com
Fri Jan 24 10:06:33 UTC 2014


On Fri, Jan 24, 2014 at 10:53:02AM +0100, Jakub Hrozek wrote:
> Hi,
> 
> During further testing, Kaushik found out that requesting an ID that
> doesn't match any configured ID mapping domain still emits strange error
> messages:
> 
> (Wed Jan 22 11:35:58 2014) [sssd[be[sssdad2012.com]]]
> [ad_account_info_complete] (0x0010): Bug: dp_error is OK on failed
> request(Wed Jan 22 11:35:58 2014) [sssd[be[sssdad2012.com]]]
> [acctinfo_callback] (0x0100): Request processed. Returned 3,5,Internal
> Error (Memory buffer error)
> 
> This is related to https://fedorahosted.org/sssd/ticket/2200
> 
> I noticed that we treat any error from ID mapping functions as equally
> fatal, including NO_DOMAIN. The attached patch treats NO_DOMAIN as if
> search went through but found nothing.
> 
> I have two questions I wasn't sure about:
>  * Is it OK to keep calling the label in users_get_send() and
>  groups_get_send() fail even if we use this label for "soft failure"?
>  I simply didn't want to make the patch bigger by renaming the label

given the fact that chances are high that this inconsistency is present
in other parts as well I think it is acceptable, especially for 1.11.
But please file a ticket to change this and maybe review the usage at
other places as well.

> 
>  * sss_idmap_unix_to_sid() is also called in ad_account_can_shortcut()
>  where I didn't change anything, but in retrospective, I think it would
>  be nicer if ad_account_can_shortcut() simply returned a boolean. If
>  noone opposes, I'll prepare a patch for master only (or ask someone to
>  do that :-))

Since the return code is only used to print a debug message and to make
sure that the boolean is set to false I agree that it can be skipped.

bye,
Sumit



More information about the sssd-devel mailing list