Clarify debug message about initgroups and subdomains

The initgroups request is not handled by the IPA provider for
subdomain users on purpose because the group membership information is
not available on the IPA server but will be directly written to the
cache when the PAC of the user is processed. The old generic debug
message "Invalid sub-domain request type" might be misleading.

This patch adds a specific message for the initgroups case "Initgroups
requests are not handled by the IPA provider but are resolved by the
responder directly from the cache." and increase the debug level so
that typically this message is not shown anymore because it is expected
behaviour.

Fixes https://fedorahosted.org/sssd/ticket/1610

1 files changed, 7 insertions, 0 deletions

diff --git a/src/providers/ipa/ipa_subdomains_id.c b/src/providers/ipa/ipa_subdomains_id.c
index 5a4ab40b2..563fdf2f6 100644
--- a/src/providers/ipa/ipa_subdomains_id.c
+++ b/src/providers/ipa/ipa_subdomains_id.c
@@ -99,6 +99,13 @@ struct tevent_req *ipa_get_subdomain_account_info_send(TALLOC_CTX *memctx,
                                        SDAP_OPTS_GROUP, NULL,
                                        &state->attrs, NULL);
             break;
+        case BE_REQ_INITGROUPS:
+            ret = ENOTSUP;
+            DEBUG(SSSDBG_TRACE_FUNC, ("Initgroups requests are not handled " \
+                                      "by the IPA provider but are resolved " \
+                                      "by the responder directly from the " \
+                                      "cache.\n"));
+            break;
         default:
             ret = EINVAL;
             DEBUG(SSSDBG_OP_FAILURE, ("Invalid sub-domain request type.\n"));