[SSSD] [PATCH] Ignore referrals when ldap_referrals=false

Pavel Reichl preichl at redhat.com
Tue Sep 2 11:50:46 UTC 2014


On 08/20/2014 03:20 PM, Jakub Hrozek wrote:
> Hi,
>
> with the current SSSD code, an LDAP search that results in a referral
> fails completely with EIO and usually sends the whole backend to
> offline mode. I think this is too strict and if the admin chose to
> ignore referrals, we should just skip these results.
>
> John Hodrien in particular was hit by us treating referrals as fatal in
> environment where he needs to restrict the search scope by using custom
> LDAP search bases.
>
> Also, in cases where Global Catalog support is disabled or GC not available
> and a group contains a user from a trusted domain, trying to search for
> this DN yields a referral.
>
> Attached is a patch that ignores referrals when the admin set
> ldap_referrals=false in the config file.
>
> Given the sdap async code is quite old and I don't remember all the
> use-cases, I CC-ed Stephen directly to get some advice. Is there any
> risk in ignoring referrals?
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
ACK
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20140902/d0e6586d/attachment.html>


More information about the sssd-devel mailing list