[autobackport: sssd-2-13] sdap: defer libldap global options setup to first connection#8746
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request refactors the initialization of global libldap options (debug level and TLS configuration) by consolidating the calls to setup_ldap_debug and setup_tls_config into a single, lazily-evaluated function sdap_setup_libldap_global_options. This new function uses a static guard to ensure global options are configured exactly once, and is invoked within sdap_connect_send instead of during individual provider initialization phases (AD, IPA, LDAP). There are no review comments, so no feedback is provided.
thalman
left a comment
thalman
left a comment
There was a problem hiding this comment.
Well backported, CI failures are not caused by this change.
alexey-tikhonov
added
no-backport
During initialization LDAP/AD/IPA backends unconditionally call `setup_tls_config()` and `setup_ldap_debug()` that call `ldap_set_option()`. This triggers `ldap_int_initialize()` -> `getaddrinfo(local_hostname)`. If DNS is unresponsive, this blocks and the backend doesn't complete initialization in time, so that 'monitor' terminates the entire SSSD. Move these calls out of the module init path into a new `sdap_setup_libldap_global_options()` wrapper guarded by a static bool. Call it from `sdap_connect_send()` just before `sss_ldap_init_send()`, which is the single entry point for all LDAP connections. :fixes:Fixed an issue where SSSD fails to start when DNS is unresponsive. Assisted-By: Claude Code (Opus 4.6) Reviewed-by: Dan Lavu <[email protected]> Reviewed-by: Sumit Bose <[email protected]> Reviewed-by: Tomáš Halman <[email protected]> (cherry picked from commit b84e7fa)
|
The pull request was accepted by @alexey-tikhonov with the following PR CI status: 🟢 rpm-build:centos-stream-10-x86_64:upstream (success) There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging. |
f9e87eb to
16149f5
Compare
4 participants
This is an automatic backport of PR#8709 sdap: defer libldap global options setup to first connection to branch sssd-2-13, created by @alexey-tikhonov.
Please make sure this backport is correct.
Note
The commits were cherry-picked without conflicts.
You can push changes to this pull request
Original commits
b84e7fa - sdap: defer libldap global options setup to first connection
Backported commits
Original Pull Request Body
During initialization LDAP/AD/IPA backends unconditionally call
setup_tls_config()andsetup_ldap_debug()that callldap_set_option(). This triggersldap_int_initialize()->getaddrinfo(local_hostname). If DNS is unresponsive, this blocks and the backend doesn't complete initialization in time, so that 'monitor' terminates the entire SSSD.Move these calls out of the module init path into a new
sdap_setup_libldap_global_options()wrapper guarded by a static bool. Call it fromsdap_connect_send()just beforesss_ldap_init_send(), which is the single entry point for all LDAP connections.:fixes:Fixed an issue where SSSD fails to start when DNS is unresponsive.
Assisted-By: Claude Code (Opus 4.6)