[PATCH] Get the RootDSE after binding if not successfull before

[Jakub Hrozek]

https://fedorahosted.org/sssd/ticket/1258

The ticket mentioned that ID lookups were failing..I didn't reproduce
that, I only reproduced that dereference was not available if rootDSE
was not read.

[Jakub Hrozek]

On Fri, Apr 20, 2012 at 04:58:31PM +0200, Jakub Hrozek wrote:
>  https://fedorahosted.org/sssd/ticket/1258
>  
>  The ticket mentioned that ID lookups were failing..I didn't reproduce
>  that, I only reproduced that dereference was not available if rootDSE
>  was not read. 
As Stephen explained on IRC, the problem is that HBAC uses dereference
unconditionally and the access check fails if we are not able to
dereference host info.

I've tested that with the patch applied, HBAC works fine even when
anonymous binds are disabled and fails without the patch.

[Stephen Gallagher]

On Fri, 2012-04-20 at 16:58 +0200, Jakub Hrozek wrote:
>  https://fedorahosted.org/sssd/ticket/1258
>  
>  The ticket mentioned that ID lookups were failing..I didn't reproduce
>  that, I only reproduced that dereference was not available if rootDSE
>  was not read. 
Ack.

For the record, the piece that is broken is HBAC handling without this.
In the HBAC provider we unconditionally use the dereference control, and
that was failing (I tested this was the case and that this patch fixes
it).

[Stephen Gallagher]

On Fri, 2012-04-20 at 12:25 -0400, Stephen Gallagher wrote:
>  On Fri, 2012-04-20 at 16:58 +0200, Jakub Hrozek wrote:
>  > https://fedorahosted.org/sssd/ticket/1258
>  > 
>  > The ticket mentioned that ID lookups were failing..I didn't reproduce
>  > that, I only reproduced that dereference was not available if rootDSE
>  > was not read.
>  
>  Ack.
>  
>  For the record, the piece that is broken is HBAC handling without this.
>  In the HBAC provider we unconditionally use the dereference control, and
>  that was failing (I tested this was the case and that this patch fixes
>  it). 
Pushed to master and sssd-1-8.