Draft
Conversation
(cherry picked from commit 0f5f3b6)
so it can be directly modified
So it can be modified later.
This crafts and implements the new failover interface, it does not provide complete implementation of the failover mechanism yet. It brings the code to a state were the public and private interfaces are stable, working and testable so the following tasks can be split and work on in parallel. What is missing at this state: - server configuration and discovery (failover_server_group/batch/vtable_op) - server selection mechanism (sss_failover_vtable_op_server_next) - kerberos authentication - sharing servers between IPA/AD LDAP and KDC - online/offline callbacks (resolve callback should not be needed) But especially it is possible to start refactoring SSSD code to start using the new failover implementation.
Assisted by: Claude code (Sonnet 4.6)
In low level ldap search functions
The data provider handler methods now return a single output argument. Remove 'dp_error/dp_err' and 'error_message' usage across provider code. The getAccountDomain method still needs to return 'domain_name' string. Assisted by: Claude code (Sonnet 4.6)
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new failover mechanism for SSSD, replacing the previous connection management and retry logic. It includes the addition of a new failover framework, updates to the AD and LDAP providers to utilize this framework, and significant refactoring of the data provider interface to simplify error handling. A critical bug was identified in the AD provider initialization where the Global Catalog failover context was not being correctly validated.
| init_ctx->gc_fctx = sssm_ad_init_failover(init_ctx, be_ctx, | ||
| init_ctx->id_ctx->sdap_id_ctx->opts, | ||
| "AD_GC", 3268); | ||
| if (init_ctx->fctx == NULL) { |
There was a problem hiding this comment.
The condition if (init_ctx->fctx == NULL) is checked twice for the same variable init_ctx->fctx instead of checking init_ctx->gc_fctx for the second initialization. This is a critical bug as it prevents proper error handling for the Global Catalog failover context initialization.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| /* Ret is only ENOENT now. Try the next connection */ | ||
| state->cindex++; | ||
| // state->cindex++; |
| } | ||
|
|
||
| ret = ad_get_account_domain_connect_retry(req); | ||
| // id_ctx->gc_ctx->ignore_mark_offline = true; |
| } | ||
|
|
||
| dom_id_ctx->ldap_ctx->ignore_mark_offline = true; | ||
| //dom_id_ctx->ldap_ctx->ignore_mark_offline = true; |
Comment on lines
+3091
to
+3093
| /* FIXME: Placeholder to be updated when | ||
| * AD is moved to new Failover | ||
| * Set to state->conn */ |
justin-stephenson
force-pushed
the
failover_justin_port_ldap_and_ad
branch
4 times, most recently
from
c913e5e to
f048402
Compare
- Servers are hardcoded
This will be done differently inside the failover code
To allow system tests to run in upstream PRCI
** Temporary commit as each provider is ported to new failover ** These provider tests will often fail because they have not yet been ported to the new failover code, and they call into ldap functions which are utilizing the new failover. For example crash in : #0 0x00007fdb8d72cb41 in sss_failover_transaction_ex_send () from /usr/lib64/sssd/libsss_ldap_common.so #1 0x00007fdb8d72ccbd in sss_failover_transaction_send () from /usr/lib64/sssd/libsss_ldap_common.so #2 0x00007fdb8d6e367b in groups_by_user_send () from /usr/lib64/sssd/libsss_ldap_common.so #3 0x00007fdb8d6e6a88 in sdap_handle_acct_req_send () from /usr/lib64/sssd/libsss_ldap_common.so #4 0x00007fdb8d799076 in ipa_id_get_account_info_get_original_step () from /usr/lib64/sssd/libsss_ipa.so #5 0x00007fdb8d7a038b in ipa_id_get_account_info_send () from /usr/lib64/sssd/libsss_ipa.so #6 0x00007fdb8d7a2560 in ipa_account_info_send () from /usr/lib64/sssd/libsss_ipa.so #7 0x00007fdb8d7a2877 in ipa_account_info_handler_send () from /usr/lib64/sssd/libsss_ipa.so
* test_failover tests are expected to fail due to failover interface changes. * test_logging 'offline' tests and test_autofs__propagate_offline_status_for_multiple_domains fail because they are asserting offline related log messages which are not in the new failover code. tests/test_autofs.py::test_autofs__propagate_offline_status_for_multiple_domains (ldap) FAILED [ 35%] tests/test_failover.py::test_failover__reactivation_timeout_is_honored[None-31] (ldap) FAILED [ 39%] tests/test_failover.py::test_failover__reactivation_timeout_is_honored[15-31] (ldap) FAILED [ 39%] tests/test_failover.py::test_failover__reactivation_timeout_is_honored[60-60] (ldap) FAILED [ 39%] tests/test_failover.py::test_failover__connect_using_ipv4_second_family (ldap) FAILED [ 40%] tests/test_logging.py::test_logging__default_settings_logs_offline_errors (ldap) FAILED [ 60%] tests/test_logging.py::test_logging__default_settings_logs_to_syslog_when_ldap_is_offline (ldap) FAILED [ 60%]
justin-stephenson
force-pushed
the
failover_justin_port_ldap_and_ad
branch
from
f048402 to
50ae477
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.