SSSD / sssd

#3722 Possible infinite loop with ldap referrals
Closed: wontfix by pbrezina. Opened by firstyear.

Closed: wontfix
Reopen Issue

When using Active Directory as a generic LDAP source as:

id_provider = ldap

Without 'ldap_referrals = False' sssd becomes unresponsive and unable to service queries. I suspect this is due to AD always returning referrals on every ldap query, and SSSD following them in an infinite loop.

SSSD should not visit a referral more than once during processing to prevent this issue. Alternately, if this is not the cause of the issue, then SSSD should be able to handle these more efficiently.

Thanks,

The issue why sssd becomes unresponsive is well known. I'm not sure if it's an infinite loop or that the rebinding to the referrals is blocking.

We've tried in the distant past to implement asynchronous referral chasing in SSSD itself, but it was a really huge task without a clear benefit -- instead, documenting to disable referrals and disabling them by default with the AD provider which is what most people are using was "good enough".

Since this is so far the only request to follow referrals in an AD setup, I'm not sure we're going to find the time to work on this ourselves. Instead, I would file the ticket into the 'patches welcome' part..

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD Patches welcome

Thank you for taking time to submit this request for SSSD. Unfortunately this issue was not given priority and the team lacks the capacity to work on it at this time.

Given that we are unable to fulfill this request I am closing the issue as wontfix.

If the issue still persist on recent SSSD you can request re-consideration of this decision by reopening this issue. Please provide additional technical details about its importance to you.

Thank you for understanding.

Metadata Update from @pbrezina:
- Issue close_status updated to: wontfix
- Issue status updated to: Closed (was: Open)

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4731

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.