Bug 741264 - [RFE] SSSD should chase referrals explicitly
Summary: [RFE] SSSD should chase referrals explicitly
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: pre-dev-freeze
: ---
Assignee: SSSD Maintainers
QA Contact: Namita Soman
Depends On:
Blocks: 756082
TreeView+ depends on / blocked
Reported: 2011-09-26 12:49 UTC by Stephen Gallagher
Modified: 2020-05-04 10:23 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Enhancement
Doc Text:
Clone Of:
Last Closed: 2016-01-18 20:51:04 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
FedoraHosted SSSD 860 0 None None None Never
Github SSSD sssd issues 1902 0 None closed [RFE] SSSD should chase referrals explicitly 2020-07-09 13:02:25 UTC

Description Stephen Gallagher 2011-09-26 12:49:30 UTC
Description of problem:
Active Directory performs some referral chasing that is incompatible with the referral mechanism included in the openldap libraries.

Notably, Active Directory will sometimes attempt to return a referral on an LDAP bind attempt, which used to cause a hang and is now simply denied by the openldap libraries.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Exact steps unknown. Related to the layout of users and groups on the AD server.
Actual results:
Performance issues and occasional failures resulting in missing information (forces SSSD to go offline)

Expected results:
All referrals should be traced properly.

Additional info:

In the majority of deployments (those not using partial replication to replicate only local users and groups), referral-chasing is unnecessary. In such cases, the recommended workaround is to disable referral-chasing by setting 'ldap_referrals = false' in the [domain/DOMAINNAME] section of sssd.conf

This issue is being tracked upstream by https://fedorahosted.org/sssd/ticket/860 by rewriting the referral code and processing it in the SSSD instead of relying on the openldap libraries to do it.

Comment 4 Jakub Hrozek 2016-01-18 20:51:04 UTC
Thank you taking your time and submitting this request for Red Hat Enterprise
Linux. Unfortunately, this bug was not given a priority and was deferred both
in the upstream project and in Red Hat Enterprise Linux.

Given that we are unable to fulfill this request in following Red Hat
Enterprise Linux releases, I am closing the Bugzilla as DEFERRED. To request
that Red Hat re-considers the decision, please re-open the Bugzilla via
appropriate support channels and provide additional business and/or technical
details about its importance to you.

Note that you can still track this request or even contribute patches in the
referred upstream Trac ticket.

Note You need to log in before you can comment on or make changes to this bug.