From ab1b2addcf0d72898ba96a5a956ea4c59c74b66e Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Nov 08 2012 11:46:40 +0000
Subject: Clarify debug message about initgroups and subdomains


The initgroups request is not handled by the IPA provider for
subdomain users on purpose because the group membership information is
not available on the IPA server but will be directly written to the
cache when the PAC of the user is processed. The old generic debug
message "Invalid sub-domain request type" might be misleading.

This patch adds a specific message for the initgroups case "Initgroups
requests are not handled by the IPA provider but are resolved by the
responder directly from the cache." and increase the debug level so
that typically this message is not shown anymore because it is expected
behaviour.

Fixes https://fedorahosted.org/sssd/ticket/1610

---

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 5a4ab40..563fdf2 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -99,6 +99,13 @@ struct tevent_req *ipa_get_subdomain_account_info_send(TALLOC_CTX *memctx,
                                        SDAP_OPTS_GROUP, NULL,
                                        &state->attrs, NULL);
             break;
+        case BE_REQ_INITGROUPS:
+            ret = ENOTSUP;
+            DEBUG(SSSDBG_TRACE_FUNC, ("Initgroups requests are not handled " \
+                                      "by the IPA provider but are resolved " \
+                                      "by the responder directly from the " \
+                                      "cache.\n"));
+            break;
         default:
             ret = EINVAL;
             DEBUG(SSSDBG_OP_FAILURE, ("Invalid sub-domain request type.\n"));