Bug 2000476

Summary:	disabled root ad domain causes subdomains to be marked offline
Product:	Red Hat Enterprise Linux 9	Reporter:	Alexey Tikhonov <atikhono>
Component:	sssd	Assignee:	Sumit Bose <sbose>
Status:	CLOSED ERRATA	QA Contact:	Dan Lavu <dlavu>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	9.0	CC:	dlavu, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, tscherf
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	sync-to-jira
Fixed In Version:	sssd-2.6.1-1.el9	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-05-17 16:00:30 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2011224
Bug Blocks:

Description Alexey Tikhonov 2021-09-02 08:45:03 UTC

This bug was initially created as a copy of Bug #2000238

I am copying this bug because: to track fix for RHEL9



[+] Description of problem:
 - when the root ad domain is not listed in ad_enabled_domains, sssd will mark the subdomains as offline

[+] Version-Release number of selected component (if applicable):
 - sssd-1.16.5-10.el7_9.8.x86_64

[+] How reproducible:
 - sometimes - the failure occurs when sssd tries to retrieve trust information from the root domain

[+] Steps to Reproduce:
1. configure an ad forest with two or more domains
2. enable only the ad subdomains in ad_enabled_domains
3. monitor sssd to see subdomains marked offline

[+] Actual results:
 - all domains are marked offline and sssd fails to perform user lookups for a certain period

[+] Expected results:
 - root domain being disabled is treated as normal and sssd keeps all subdomains online

[+] Workaround:
 - list ad root domain in ad_enabled_domains

Comment 1 Alexey Tikhonov 2021-09-02 10:30:30 UTC

Upstream PR: https://github.com/SSSD/sssd/pull/5771

Comment 2 Alexey Tikhonov 2021-09-24 13:24:59 UTC

Pushed PR: https://github.com/SSSD/sssd/pull/5771

* `master`
    * 2a617c0efc07d10efc0688652bfe7ab2d8d6f477 - sdap: always create sdap object for a forest root
* `sssd-1-16`
    * 46b194196749d4ea77d5d4e6bdd64d7c0996b105 - sdap: always create sdap object for a forest root

Comment 11 errata-xmlrpc 2022-05-17 16:00:30 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (new packages: sssd), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:4015