On 01/05/2016 05:33 PM, Jakub Hrozek wrote:
On Tue, Jan 05, 2016 at 02:12:51PM +0100, Pavel Březina wrote:
On 12/14/2015 03:36 PM, Petr Cech wrote:
Hi all,
there is patch for https://fedorahosted.org/sssd/ticket/2791 attached.
Result of patch:
The message:
Dec 14 14:16:11 vm-058-166 sssd[be[uma.dev]]: dereference processing
failed : Input/output error
is replaced by
Dec 14 15:29:26 vm-058-166 sssd[be[uma.dev]]: LDAP server claims to
support deref, but deref search failed. Disabling deref for further
requests. You can permanently disable deref by setting
ldap_deref_threshold to 0 in domain configuration.
But I am little afraid of this patch. Why? I tested this work on RHEL 6
how it is described in the ticket.
If I tried to set
ldap_deref_threshold = 0
it was still falling into bad case and printed I/O error. So, if we
considered patch is right, there is question if advice in new message is
valid for IPA 3.x.
Regards
Petr
This threshold parameter applies for groups membership, not for views where
dereference is always used in current code.
The question is, why does sdap_x_deref_search_send fail with EIO?
Dereference should be supported with IPA...
Because the dereferenced attribute doesn't exist on the server IIRC.
Then the debug message is misleading since dereference is in fact
working. We should return different error code if possible (ENOENT?) and
this case should be handled in views code.
The thing is, I wonder if we should remove the ENOSUP?
_______________________________________________
sssd-devel mailing list
sssd-devel@lists.fedorahosted.org
https://lists.fedorahosted.org/admin/lists/sssd-devel@lists.fedorahosted.org
