Hide Forgot
Description of problem: Customer is being hit by this bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596983 (author of nss-pam-ldapd fixed in in 0.7.10, RHEL6 uses 0.7.5) As they are using LDAP to distribute user information to their computing nodes, this bug is quite critical for them: if the first LDAP server becomes unreachable they loose all LDAP access from client. (The only workaround being to restart nslcd on the system - it will fallback at the bind time). Version-Release number of selected component (if applicable): nss-pam-ldapd-0.7.5-3.el6 How reproducible: 100% Steps to Reproduce: 1. Configure nslcd to use more than one LDAP server 2. Use iptables to drop connections to the first configured LDAP server Actual results: nslcd continues to attempt to connect to the first configured LDAP server. Expected results: nslcd falls over to using a different LDAP server than the first configured one.
Created attachment 489343 [details] Proposed patch Relevant bit from diff between the upstream changelogs for 0.7.9 and 0.7.10: + * [r1211] ., nslcd/myldap.c: handle errors from ldap_result() + better and disconnect (and reconnect) in more cases (r1207 and + r1208 from trunk) As such, the proposed patch is the combination of <http://arthurdejong.org/viewvc/nss-pam-ldapd?view=revision&revision=1207> and <http://arthurdejong.org/viewvc/nss-pam-ldapd?view=revision&revision=1208>.
Have they looked at SSSD?
We are in the same boat. What is the timeline to have this fix available?
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: When nslcd was configured to use multiple LDAP servers, it failed to fall back to a different server in case the primary server could not be reached. This was due to nslcd trying to keep the first connection alive even when the connection was dropped. With this update, nslcd correctly falls back to a different server after loosing connection with the current one.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0796.html