In violation of the standard, some LDAP servers control access to the RootDSE, thus preventing us from being able to read it before performing a bind. This patch will allow us to continue on if the RootDSE was inaccessible. All of the places that we use the return value of the RootDSE after this are already checked for NULL and use sane defaults if the RootDSE is unavailable. I was poking around related code today and realized that the fix for this was actually very easy (as at present we are only using the result of the rootDSE lookup to determine if we can perform a GSSAPI bind, but it's already covered to just skip the check and assume that the server is capable if the rootDSE object is empty. There is one other place, in sdap_initgr_nested_send() where we have a TODO in place to use the rootDSE to detect deref and ASQ support, but we are not actually doing so yet anyway. I think this will solve https://fedorahosted.org/sssd/ticket/497 easily, and I think it's worth re-targeting to 1.2.2. This patch applies to both master and sssd-1-2. -- Stephen Gallagher RHCE 804006346421761 Delivering value year after year. Red Hat ranks #1 in value among software vendors. http://www.redhat.com/promo/vendor/