Issue: multiple ad_server entries breaks update

[slapcat]

Is there an existing issue for this?

• I have searched the existing issues and found none that matched mine

Describe the issue

If multiple hosts are specified in the ad_server option of SSSD for high availability, adsysd constructs an invalid ldap URL and fails to connect:

DEBUG github.com/ubuntu/adsys/internal/ad/ad.go:259 (*AD).GetPolicies() Getting gpo list with arguments: "--objectclass computer dc1.windows.lan,dc2.windows.lan adsys" 
ERRORgithub.com/ubuntu/adsys/cmd/adsysd/main.go:52 main.run() Error from server: error while updating policy: can't get policies for "adsys": failed to retrieve the list of GPO (exited with 2): exit status 2
Failed to connect to ldap URL 'ldap://dc1.windows.lan,dc2.windows.lan' - LDAP client internal error: NT_STATUS_OBJECT_NAME_NOT_FOUND
Failed to connect to 'ldap://dc1.windows.lan,dc2.windows.lan' with backend 'ldap': LDAP client internal error: NT_STATUS_OBJECT_NAME_NOT_FOUND 

This is valid SSSD configuration and should be supported by adsys.

Steps to reproduce it

1. Set ad_server in /etc/sssd/sssd.conf to a comma-separated list of multiple DC hostnames
2. sudo systemctl restart sssd
3. sudo adsysctl policy update -m -vvv

Ubuntu users: System information

report.txt

Non Ubuntu users: System information

Environment

• adsys version: please run adsysctl version
• Distribution: (NAME in /etc/os-release)
• Distribution version: (VERSION_ID on /etc/os-release):

Log files

Please redact/remove sensitive information:

adsys service logs can be acquired by running `adsysctl service cat -v`.
You can increase the amount of information displayed by increasing the verbosity level (-v) to -vv or -vvv.

Application settings

Please redact/remove sensitive information:

Paste the contents of your adsys.yaml file here, if you created one.

Additional information

No response

Double check your logs

• I have redacted any sensitive information from the logs

[slapcat]

A workaround I found is to add the multiple hostnames as a configuration snippet, which adsys apparently doesn't read. The default sssd.conf should only list one. This way SSSD will know the fallback servers but adsys will only read the single config file at /etc/sssd/sssd.conf. That is likely another bug though.

# cat /etc/sssd/conf.d/multi-server.conf 
[domain/windows.lan]
ad_server = dc1.windows.lan,dc2.windows.lan

This workaround also leaves adsys with a single point of failure still.