[SSSD] [PATCH] ipa: do not treat missing sub-domain users as error

Jakub Hrozek jhrozek at redhat.com
Fri Mar 13 15:03:40 UTC 2015


On Fri, Mar 13, 2015 at 02:36:25PM +0100, Jakub Hrozek wrote:
> On Mon, Mar 09, 2015 at 10:40:52AM +0100, Sumit Bose wrote:
> > Hi,
> > 
> > with this patch missing user and groups from trusted domains are not
> > handled as error anymore but just as unresolvable objects. Please note
> > that older versions of the IPA extdom plugin did not return
> > LDAP_NO_SUCH_OBJECT in all cases so this detection only work reliable
> > with IPA trees which already contain a patch called 'extdom: return
> > LDAP_NO_SUCH_OBJECT to the client'.
> 
> I tested with today's freeipa git master plus some other extdom patches
> pending review.
> 
> Before the patches I got:
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null).
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation failed, server logs might contain more details.
> [sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
> [sssd[be[ipa.example.com]]] [ipa_subdomain_account_done] (0x0040): ipa_get_*_acct request failed: 1432158222
> [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 3 errno: 1432158222 error message: Account info lookup failed
> [sssd[nss]] [nss_cmd_getby_dp_callback] (0x0040): Unable to get information from Data Provider
> 
> After applying the patches I see:
> [sssd[be[ipa.example.com]]] [ipa_s2n_exop_done] (0x0040): ldap_extended_operation result: No such object(32), (null).
> [sssd[be[ipa.example.com]]] [ipa_s2n_get_user_done] (0x0040): s2n exop request failed.
> [sssd[nss]] [sss_dp_get_reply] (0x1000): Got reply from Data Provider - DP error code: 0 errno: 0 error message: Success (Success)
> 
> The most crucial part is that NSS responder no longer treats the missing
> object as a failure.

* master:
    * 7ee9ac32485483beece872d6fcb3096fa77a004b
    * 3e9712c2fdbba8f9cd25886943331e76e0b2cedd
* sssd-1-12:
    * 052e37d891612ea4637c6de99cc4982383d65947
    * 8d13b13f8f5bbcdac7161d55d60cb5eedaccd95c

Sorry there is no CI link, but rawhide seems to be taking ages. Other
releases already passed, so went ahead and pushed the patches.



More information about the sssd-devel mailing list