[SSSD] [PATCH] LDAP: Detect the presence of POSIX attributes

Jakub Hrozek jhrozek at redhat.com
Tue Jan 28 22:23:24 UTC 2014


On Mon, Jan 27, 2014 at 11:33:36PM +0100, Jakub Hrozek wrote:
> Hi,
> 
> When the schema is set to AD and ID mapping is used, there is a one-time
> check ran when searching for users to detect the presence of POSIX attributes
> in LDAP. If this check fails, the search fails as if no entry was found
> and returns a special error code.
> 
> If the AD identity lookup finds this error code, the GC is disabled for
> the next search.
> 
> The sdap_server_opts structure is filled every time a client connects to
> a server so the posix check boolean is reset to false again on connecting
> to the server.
> 
> It might be better to move the check to where the rootDSE is retrieved,
> but the check depends on several features that are not known to the code
> that retrieves the rootDSE (or the connection code for example) such as what
> the attribute mappings are or the authentication method that should be used.
> 
> Currently this patch only runs the check when users are requested. It
> would be trivial to add the same code (about 70 lines) to the group
> request as well.
> 
> Additionally, I wonder if the absence of POSIX attributes in GC should
> be reported louder. Currently there is just MINOR_FAILURE.
> 
> We could go as far as report to syslog when a user or a group from
> subdomains is requested and the GC was already disabled, but I wanted to
> check with the other developers before implementing this.

One additional question -- currently the AD ID provider always retries
in LDAP if search in GC didn't find the result. With the possibility of
detecting the POSIX attributes, do we want to remove this fallback if we
were able to run the detection and know that GC is available but doesn't
contain the POSIX attributes?

I would say the fallback should stay, because there is still a chance
other required attribute will be missing, after all the user can
configure additional filter and this fallback only affects negative
searches.



More information about the sssd-devel mailing list