New failover implementation by pbrezina · Pull Request #8566 · SSSD/sssd

pbrezina · 2026-03-31T10:33:31Z

This pull request is intended to be a start of a "failover" feature branch where other developers will be able to contribute.

The main failover logic works, compiles and can be tested using a "minimal" provider that is included as an example. The purpose of the "minimal" provider is only to test the failover without the need to port full provider code and itwill be removed prior pushing the contents to the master branch. See how to set it up in minimal-provider-notes.txt and see the switch to new failover in commit minimal: switch to new failover for service lookup and user authentication - this is the minimal set of changes to get it working, but the real port should get and will require more refactoring.

The work is still not finished and there is missing functionality. This functionality, however, can be implemented in small areas of code and should not require larger changes or glues in the whole code base, so this is ready for review. Remaining work is tracked at [1]. Feel free to take any of these tickets and open new tickets when you find something missing.

When reviewing, you can start with src/providers/failover/readme.md that provides high level documentation of the code. And of course do not forget the design page [2].

Thanks, Pavel

gemini-code-assist

Code Review

This pull request implements a new failover mechanism for SSSD, introducing prioritized server groups, parallelized candidate server discovery, and a transaction-based API for automated retries. It also provides a minimal provider implementation to demonstrate the new architecture. Critical logic bugs were identified in the server group resolution logic, where duplicate detection causes premature loop exit, and in the address change detection function, which currently returns inverted results.

+#include "providers/failover/ldap/failover_ldap.h"
+
+static errno_t
+find_password_expiration_attributes(TALLOC_CTX *mem_ctx,


+    switch (ar->entry_type & BE_REQ_TYPE_MASK) {
+    case BE_REQ_SERVICES:
+        DEBUG(SSSDBG_TRACE_FUNC, "Executing BE_REQ_SERVICES request\n");
+
+        subreq = minimal_services_get_send(state, be_ctx->ev, fctx, id_ctx,
+                                           sdom, ar->filter_value,
+                                           ar->extra_value, ar->filter_type,
+                                           noexist_delete);
+        break;
+    default: /*fail*/
+        ret = EINVAL;
+        state->err = "Invalid request type";
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Unexpected request type: 0x%X [%s:%s] in %s\n",
+              ar->entry_type, ar->filter_value,
+              ar->extra_value?ar->extra_value:"-",
+              ar->domain);
+        goto done;
+    }


+    switch (state->ar->entry_type & BE_REQ_TYPE_MASK) {
+    case BE_REQ_SERVICES:
+        err = "Service lookup failed";
+        ret = minimal_services_get_recv(subreq);
+        break;
+    default: /* fail */
+        ret = EINVAL;
+        break;
+    }


+    // TODO handle how to yield ERR_SERVER_FAILED
+    // ret = sdap_id_op_done(state->op, ret, &dp_error);
+    // if (dp_error == DP_ERR_OK && ret != EOK) {
+    //     /* retry */
+    //     ret = minimal_services_get_retry(req);
+    //     if (ret != EOK) {
+    //         tevent_req_error(req, ret);
+    //         return;
+    //     }


+    //     /* Return to the mainloop to retry */
+    //     return;
+    // }
+    // state->sdap_ret = ret;


alexey-tikhonov · 2026-04-10T13:17:33Z

@pbrezina, is it expected CI fails to build?

src/providers/minimal/minimal_id.c:28:10: fatal error: providers/minimal/minimal.h: No such file or directory

alexey-tikhonov · 2026-04-13T09:13:51Z

@pbrezina,
re: "oidc_child: parameterize entra_idp url" (and other) commits being included in this PR: imo, it's better to rebase base branch (https://github.com/SSSD/sssd/tree/failover) and not current PR in review (https://github.com/pbrezina/sssd/tree/failover)

alexey-tikhonov · 2026-04-13T09:17:12Z

FreeBSD CI doesn't have required headers installed:


  src/providers/minimal/minimal_ldap_auth.c:32:10: fatal error: 'shadow.h' file not found
     32 | #include <shadow.h>
        |          ^~~~~~~~~~

While 'minimal' isn't going to be merged in main repo branches, this 'fail to build' can hide other issues.

…ider (cherry picked from commit 0f5f3b6)

so it can be directly modified

…can easily pass new fctx

So it can be modified later.

…kup and user authentication

…pec file Add the sssd-minimal provider package to the spec file following the same pattern as other providers (ldap, ipa, ad, etc.). This packages the libsss_minimal.so library that was added in recent commits. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

pbrezina · 2026-04-13T12:41:12Z

Now it is fixed. There were missing headers in noinst_HEADERS and some other problems. I reordered the commits and every commit for testing only is clearly marked to not go to master.

Reviewer needs to pay attention only to the "failover" commit, other commits are just for testing and a demostration.

And also disable codeql for the minimal provider. The provider is for testing only, it does not make sense to fix any issue there.

This crafts and implements the new failover interface, it does not provide complete implementation of the failover mechanism yet. It brings the code to a state were the public and private interfaces are stable, working and testable so the following tasks can be split and work on in parallel. What is missing at this state: - server configuration and discovery (failover_server_group/batch/vtable_op) - server selection mechanism (sss_failover_vtable_op_server_next) - kerberos authentication - sharing servers between IPA/AD LDAP and KDC - online/offline callbacks (resolve callback should not be needed) But especially it is possible to start refactoring SSSD code to start using the new failover implementation.

alexey-tikhonov · 2026-04-16T17:40:50Z

@pbrezina, would it be difficult to include a 'system' test using "minimal" provider and covering any failover scenario?

If it's difficult then disregard as test would be discarded eventually.

alexey-tikhonov · 2026-04-20T15:28:29Z

+
+### Failover Context
+
+* [sss_failover.c]()


Actual files are named without 'sss_' prefix.

alexey-tikhonov · 2026-04-20T15:32:06Z

What is missing at this state:

server configuration and discovery
(failover_server_group/batch/vtable_op)

server selection mechanism (sss_failover_vtable_op_server_next)

kerberos authentication

sharing servers between IPA/AD LDAP and KDC

online/offline callbacks (resolve callback should not be needed)

Periodic refreshes are also not yet implemented, right?

alexey-tikhonov · 2026-04-20T15:34:13Z

+    }
+
+    /* Switch the attempt_req state to caller_req state so it is used seamlessly
+     * by the user. This is quite a hack and the attempt_state must stay


Indeed. No other reasonable way?

alexey-tikhonov · 2026-04-20T15:35:53Z

+    errno_t ret;
+
+    state = tevent_req_data(req, struct sss_failover_transaction_state);
+    state->attempts++;


Would it make sense to limit attempts?

alexey-tikhonov · 2026-04-20T15:39:37Z

+}
+
+void
+sss_failover_server_mark_reachable(struct sss_failover_server *srv)


Looks like it's not used anywhere.
Shouldn't it be called from sss_failover_ping_done()?

alexey-tikhonov · 2026-04-20T15:46:44Z

+
+        state->current_group++;
+        ret = sss_failover_refresh_candidates_group_next(req);
+        if (ret != EOK) {


I think it should also return for ret == EOK as well?
Otherwise it will be tevent_req_done(req); below?

alexey-tikhonov · 2026-04-20T15:49:36Z

+                                      bool addr_changed,
+                                      bool reuse_connection,
+                                      bool authenticate_connection,
+                                      bool read_rootdse,


Those are pretty much LDAP specific.
Is this a good fit for abstract vtable API?

alexey-tikhonov · 2026-04-20T15:56:45Z

I did only overview / preliminary round and not sure at all if any of my comments are valid.
But setting 'changes requested' nonetheless to get a response for my comments to check my understanding so far.

gemini-code-assist Bot reviewed Mar 31, 2026

View reviewed changes

Comment thread src/providers/failover/failover_group.c Outdated

Comment thread src/providers/failover/failover_server_resolve.c Outdated

github-advanced-security AI found potential problems Mar 31, 2026

View reviewed changes

alexey-tikhonov self-assigned this Apr 1, 2026

alexey-tikhonov requested review from alexey-tikhonov April 1, 2026 09:05

alexey-tikhonov added Waiting for review no-backport This should go to target branch only. labels Apr 1, 2026

pbrezina force-pushed the failover branch 2 times, most recently from 0570a63 to 2a2c475 Compare April 13, 2026 09:09

pbrezina force-pushed the failover branch 4 times, most recently from 1fe8626 to ed511ad Compare April 13, 2026 10:47

justin-stephenson and others added 7 commits April 13, 2026 13:54

DO NOT PUSH TO MASTER minimal: Initial implementation of minimal prov…

10c8c12

…ider (cherry picked from commit 0f5f3b6)

DO NOT PUSH TO MASTER minimal: copy paste services code

f0d0a04

so it can be directly modified

DO NOT PUSH TO MASTER minimal: push init_ctx instead of id_ctx so we …

5831d94

…can easily pass new fctx

DO NOT PUSH TO MASTER minimal: add authentication provider

7b0391c

DO NOT PUSH TO MASTER minimal: copy paste authentication code

826c63f

So it can be modified later.

DO NOT PUSH TO MASTER minimal: switch to new failover for service loo…

7468954

…kup and user authentication

DO NOT PUSH TO MASTER minimal: update how to use it notes

a773ddc

pbrezina force-pushed the failover branch from ed511ad to e75bb95 Compare April 13, 2026 11:55

pbrezina force-pushed the failover branch from e75bb95 to f84c987 Compare April 13, 2026 12:04

pbrezina added 2 commits April 13, 2026 14:43

DO NOT PUSH TO MASTER ci: enable failover branch

9db35f5

And also disable codeql for the minimal provider. The provider is for testing only, it does not make sense to fix any issue there.

pbrezina force-pushed the failover branch from f84c987 to bf6c086 Compare April 13, 2026 12:44

alexey-tikhonov requested a review from justin-stephenson April 16, 2026 12:34

alexey-tikhonov assigned justin-stephenson Apr 16, 2026

alexey-tikhonov reviewed Apr 20, 2026

View reviewed changes

alexey-tikhonov added Changes requested and removed Waiting for review labels Apr 20, 2026

Conversation

pbrezina commented Mar 31, 2026

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Check warning

Check notice

Check notice

Check notice

Check notice

Uh oh!

alexey-tikhonov commented Apr 10, 2026

Uh oh!

alexey-tikhonov commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexey-tikhonov commented Apr 13, 2026

Uh oh!

pbrezina commented Apr 13, 2026

Uh oh!

alexey-tikhonov commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov commented Apr 20, 2026

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

alexey-tikhonov commented Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

alexey-tikhonov commented Apr 13, 2026 •

edited

Loading

alexey-tikhonov commented Apr 16, 2026 •

edited

Loading