[SSSD] [PATCH] IPA: do not fail if view name lookup failed on older versions
Jakub Hrozek
jhrozek at redhat.com
Mon May 11 17:13:17 UTC 2015
On Mon, May 11, 2015 at 12:01:52PM +0200, Sumit Bose wrote:
> On Mon, May 11, 2015 at 12:01:12PM +0200, Sumit Bose wrote:
> > Hi,
>
> and now with patch ...
>
> >
> > this patch fixes an issue seen when newer idview-aware SSSD clients try
> > to connect to older IPA server. As mentioned in the commit message it is
> > due to different error codes returned by different versions of 389ds.
> > This issue only becomes important when the old IPA server has a trust to
> > AD because the issue prevents SSSD from reading the SID of the IPA
> > domain. Without trust the issue can be verified by checking the logs.
> > ipa_get_view_name_done() should fail with the message "get_view_name
> > request failed, looks like server does not support views." and continue
> > to read data about the IPA domain. Without this path you should see
> > "get_view_name request failed." and the whole request should be
> > canceled.
> >
> > bye,
> > Sumit
> From 100862c31f92c644868053fe576e4acfcd34a420 Mon Sep 17 00:00:00 2001
> From: Sumit Bose <sbose at redhat.com>
> Date: Thu, 7 May 2015 11:16:54 +0200
> Subject: [PATCH] IPA: do not fail if view name lookup failed on older versions
>
> Depending on the version 389ds return a different error code if the
> search for the view name failed because our dereference attribute
> ipaAssignedIDView is not known. Newer version return
> LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to
> EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which is
> returned as EIO. In both cases we have to assume that the server is not
> view aware and keep the view name unset.
>
> Resolves https://fedorahosted.org/sssd/ticket/2650
> ---
> src/providers/ipa/ipa_subdomains.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/src/providers/ipa/ipa_subdomains.c b/src/providers/ipa/ipa_subdomains.c
> index 20657ebb556f75108f64faecc6ad1ccc1d7e26fd..f863b806c8fed01f498d18b953832ebeba7a85d3 100644
> --- a/src/providers/ipa/ipa_subdomains.c
> +++ b/src/providers/ipa/ipa_subdomains.c
> @@ -1034,7 +1034,14 @@ static void ipa_get_view_name_done(struct tevent_req *req)
> ret = sdap_deref_search_with_filter_recv(req, ctx, &reply_count, &reply);
> talloc_zfree(req);
> if (ret != EOK) {
> - if (ret == EOPNOTSUPP) {
> + /* Depending on the version 389ds return a different error code if the
> + * search for the view name failed because our dereference attribute
> + * ipaAssignedIDView is not known. Newer version return
> + * LDAP_UNAVAILABLE_CRITICAL_EXTENSION(12) which is translated to
> + * EOPNOTSUPP and older versions return LDAP_PROTOCOL_ERROR(2) which
> + * is returned as EIO. In both cases we have to assume that the server
> + * is not view aware and keep the view name unset. */
> + if (ret == EOPNOTSUPP || ret == EIO) {
Hmm, EIO is quite a generic error, do you know where is it emitted from?
Could we convert that place to a sssd-specific error to avoid shadowing
a legitimate error?
> DEBUG(SSSDBG_TRACE_FUNC, "get_view_name request failed, looks " \
> "like server does not support views.\n");
> ret = ipa_check_master(ctx);
> --
> 2.1.0
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
More information about the sssd-devel
mailing list