IPA: set sudo search base on sdom to avoid spurious ldap_sudo_search_… - #9191
Closed
madhuriupadhye wants to merge 1 commit into
Closed
IPA: set sudo search base on sdom to avoid spurious ldap_sudo_search_…#9191madhuriupadhye wants to merge 1 commit into
madhuriupadhye wants to merge 1 commit into
Conversation
…base warning With the IPA sudo provider, SSSD logs a false warning that `ldap_sudo_search_base` is not set and the whole tree will be searched — even though IPA has already scoped sudo to `cn=sudo,$basedn`. Sudo works correctly; the message is wrong. IPA parses the sudo base only into `sudo_ctx->sudo_sb` and leaves `sdom->sudo_search_bases` NULL. `sdap_set_config_options_with_rootdse()` then enters its `if (!sdom->sudo_search_bases)` block and emits the warning. (SSSD#9031 tried to guard this via an option check that doesn't hold on this path.) In `ipa_sudo_init_ipa_schema()`, also record the base on `sdom->sudo_search_bases`. It runs before any rootDSE callback, so the block is skipped and the warning never fires. IPA lookups are unchanged (they use `sudo_ctx->sudo_sb`); the LDAP path is untouched. Resolves: SSSD#9030 Assisted-By: Claude Code (Opus 4.8) Signed-off-by: Madhuri Upadhye <Madhuri Upadhye>
madhuriupadhye
marked this pull request as draft
September 1, 2026 13:33
Member
|
@madhuriupadhye, @sumit-bose, I think this approach obsoletes patch merged in #9031 and (assuming this approach is correct) it would be better to revert #9031 (in branches it was merged to)? |
Member
|
I'm setting 'Blocked' label to avoid merging accidentally, before we figure out what to do with previous patch and have functioning CI. Otherwise we won't get out of this mess. |
Member
this is probably wrong statement |
Member
|
@madhuriupadhye, please re-open if you think this PR is still needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…base warning
With the IPA sudo provider, SSSD logs a false warning that
ldap_sudo_search_baseis not set and the whole tree will be searched — even though IPA has already scoped sudo tocn=sudo,$basedn. Sudo works correctly; the message is wrong.IPA parses the sudo base only into
sudo_ctx->sudo_sband leavessdom->sudo_search_basesNULL.sdap_set_config_options_with_rootdse()then enters itsif (!sdom->sudo_search_bases)block and emits the warning. (#9031 tried to guard this via an option check that doesn't hold on this path.)In
ipa_sudo_init_ipa_schema(), also record the base onsdom->sudo_search_bases. It runs before any rootDSE callback, so the block is skipped and the warning never fires. IPA lookups are unchanged (they usesudo_ctx->sudo_sb); the LDAP path is untouched.Resolves: #9030
Assisted-By: Claude Code (Opus 4.8)