[SSSD] I think #2637 is out of scope of 1.13

Jakub Hrozek jhrozek at redhat.com
Wed Sep 2 10:42:17 UTC 2015


On Wed, Sep 02, 2015 at 10:11:46AM +0200, Sumit Bose wrote:
> On Tue, Sep 01, 2015 at 08:19:06PM +0200, Jakub Hrozek wrote:
> > Hi,
> > 
> > ssia...
> > 
> > I was working on implementing https://fedorahosted.org/sssd/ticket/2637
> > and while for most occurences it was quite easy to set domain status
> > instead of back end status, I hit the sdap_id_op module..
> > 
> > The sdap_id_op operation sets the offline status directly, in a bit of
> > a hackish way by accessing the be_ctx through sdap_id_ctx. It's not
> > trivial to change the request to operate on domains, except changing
> > sdap_id_op_create() to also accept domain as a parameter..but we already
> > have 37 calls to sdap_id_op_create().
> > 
> > A better way would be to change the whole sdap_id_op request to return an
> > error code and don't touch the backend status, but that's even more work
> > -- we need to do that and it's something we need to do in the next weeks
> > anyway, I just think it's not something that should land in 1.13..
> > 
> > Thoughts? Should I go ahead and change sdap_id_op_create() to accept
> > domain in 1.13 or do refactor the sdap_id_op for 1.14? I would
> > personally prefer the latter..
> 
> I agree that sdap_id_op should not change the status on its own and that
> it should be fixed with the refactoring planned for 1.14.
> 
> Nevertheless I wonder if you already have a patch which covers all the
> other cases if it wouldn't be an improvement to the current state to add
> it?
> 
> I would assume that most issue are caused by error during the DNS
> lookup, initial connect or authentication which iirc are not handled by
> sdap_id_op.

The LDAP connection and the failover during the connection is handled by
sdap_id_op. That's the crux of the problem I didn't realize when doing
the initial design (frankly I didn't think the sdap operation was in the
business of changing failover status and offline status for the backend..)

> I would assume that error during sdap_id_op, e.g. a server
> shutdown, are more rare and it would be acceptable to let those errors
> switch the whole backend to offline until the refactoring is done.

Hmm perhaps you're right that we can try solve at least the use-cases
while we have the code in mind. I think we mostly care about:
    - don't bring the whole AD backend offline if there are connection
      problems with discovering subdomains when AD client is connected
      to a subdomain
    - don't bring the whole IPA backend offline if there are connection
      problems with AD server in server mode
    - don't bring the while IPA backend offline if there are connection
      problems with AD server with IPA client

I think these are solvable without major hacks. I'll see about fixing
these use-cases.

The rest needs to be fixed when I work on the LDAP code and Pavel
Brezina works on the failover changes.


More information about the sssd-devel mailing list