SSSD / sssd

#1874 failover cycle detection mechanism produces false positives sometimes
Closed: Invalid Opened by jhrozek.

Closed: Invalid
Reopen Issue

This problem was reported on #sssd.

From the logfiles we have it seems that if a server is being resolved by two actions simultaneously, it may be wrongly marked as "already tried":

[unschedule_timeout_watcher] (0x4000): Unscheduling DNS timeout watcher
[resolv_gethostbyname_dns_parse] (0x1000): Parsing an A reply
[request_watch_destructor] (0x0400): Deleting request watch
[set_server_common_status] (0x0100): Marking server 'hostname' as 'name resolved'
[be_resolve_server_process] (0x1000): Saving the first resolved server
[be_resolve_server_process] (0x0200): Found address for server hostname: [1.2.3.4] TTL 123
[sdap_uri_callback] (0x0400): Constructed uri 'ldaps://hostname/'
[auth_resolve_done] (0x2000): [ldaps://hostname/] is a secure channel. No need to run START_TLS
[sss_ldap_init_send] (0x4000): Using file descriptor [21] for LDAP connection.
[sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting
[be_resolve_server_process] (0x1000): Saving the first resolved server
[be_resolve_server_process] (0x0200): Found address for server hostname: [1.2.3.4] TTL 123
[auth_resolve_done] (0x2000): [ldaps://hostname/] is a secure channel. No need to run START_TLS
[sss_ldap_init_send] (0x4000): Using file descriptor [22] for LDAP connection.
[sss_ldap_init_send] (0x0400): Setting 6 seconds timeout for connecting
[be_resolve_server_process] (0x0040): The fail over cycled through all available servers
[be_resolve_server_done] (0x1000): Server resolution failed: 2
[sdap_id_op_connect_done] (0x0020): Failed to connect, going offline (5 [Input/output error]

Note there is no delay or timeout between the two calls, seems like the second one just marked the server as "tried already"

Might not fit into 1.10 then it will be deferred to to later release.

milestone: NEEDS_TRIAGE => SSSD 1.10.0
priority: major => minor
rhbz: => todo

Fields changed

milestone: SSSD 1.10.0 => SSSD 1.10.1

Fields changed

changelog: =>
owner: somebody => pbrezina
status: new => assigned

Moving tickets that didn't make 1.10.1 to the 1.10.2 bucket.

Moving tickets that didn't make 1.10.1 to 1.10.2

milestone: SSSD 1.10.1 => SSSD 1.10.2

I wasn't able to reproduce this issue.

I tried calling several id a auth commands in parallel, having ldap server (un)resolvable, timeout on both dns and ldap part. With ldap, ipa and ad providers. It would be nice to obtain log that precedes the one attached to this ticket.

I'm closing this ticket as works for me, since we are unable to reach the original reporter. We will reopen if the issue strikes again.

resolution: => worksforme
status: assigned => closed

no clone needed, closed as worksforme

rhbz: todo => 0

Metadata Update from @jhrozek:
- Issue assigned to pbrezina
- Issue set to the milestone: SSSD 1.10.2

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/2916

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
High
defect
SSSD
1.9.4
0
None
0
0
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.