|
 |
ecf709 |
From 396849b6160594dbb6dedec5d1bd7fbc3af12cdd Mon Sep 17 00:00:00 2001
|
|
|
ecf709 |
From: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
ecf709 |
Date: Fri, 21 Apr 2017 12:39:44 +0200
|
|
|
ecf709 |
Subject: [PATCH 112/118] IPA: Improve DEBUG message if a group has no
|
|
|
ecf709 |
ipaNTSecurityIdentifier
|
|
|
ecf709 |
MIME-Version: 1.0
|
|
|
ecf709 |
Content-Type: text/plain; charset=UTF-8
|
|
|
ecf709 |
Content-Transfer-Encoding: 8bit
|
|
|
ecf709 |
|
|
|
ecf709 |
There was an issue in a production deployment where the admin selected a
|
|
|
ecf709 |
GID outside the IDM range for a group that contained a user from the
|
|
|
ecf709 |
trusted domain. This resulted in not adding a SID for the IPA group,
|
|
|
ecf709 |
which in turn meant the group couldn't be resolved on the client.
|
|
|
ecf709 |
|
|
|
ecf709 |
This patch just improves the DEBUG message so that it's clearer for the
|
|
|
ecf709 |
admins where the issue is.
|
|
|
ecf709 |
|
|
|
ecf709 |
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
|
|
|
ecf709 |
(cherry picked from commit ef019268d2d112ebff3577e551cd19478d73d93b)
|
|
|
ecf709 |
---
|
|
|
ecf709 |
src/providers/ipa/ipa_s2n_exop.c | 5 ++++-
|
|
|
ecf709 |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
ecf709 |
|
|
|
ecf709 |
diff --git a/src/providers/ipa/ipa_s2n_exop.c b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ecf709 |
index 2173db357700499a6140aa61841e443139981483..55ec904ca3188c7cf10ac41972e9ecf94ebf44bb 100644
|
|
|
ecf709 |
--- a/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ecf709 |
+++ b/src/providers/ipa/ipa_s2n_exop.c
|
|
|
ecf709 |
@@ -1308,7 +1308,10 @@ static void ipa_s2n_get_list_next(struct tevent_req *subreq)
|
|
|
ecf709 |
ret = sysdb_attrs_get_string(state->attrs->sysdb_attrs, SYSDB_SID_STR,
|
|
|
ecf709 |
&sid_str);
|
|
|
ecf709 |
if (ret != EOK) {
|
|
|
ecf709 |
- DEBUG(SSSDBG_OP_FAILURE, "sysdb_attrs_get_string failed.\n");
|
|
|
ecf709 |
+ DEBUG(SSSDBG_CRIT_FAILURE,
|
|
|
ecf709 |
+ "Object [%s] has no SID, please check the "
|
|
|
ecf709 |
+ "ipaNTSecurityIdentifier attribute on the server-side",
|
|
|
ecf709 |
+ state->attrs->a.name);
|
|
|
ecf709 |
goto fail;
|
|
|
ecf709 |
}
|
|
|
ecf709 |
|
|
|
ecf709 |
--
|
|
|
ecf709 |
2.9.3
|
|
|
ecf709 |
|