SYSDB: sysdb_search_object_by_sid returns ENOENT

sysdb_search_object_by_sid returns ENOENT if no results are found.

Part od solution for:
https://fedorahosted.org/sssd/ticket/1991

Fixes:
https://fedorahosted.org/sssd/ticket/2520

Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>

2 files changed, 27 insertions, 25 deletions

diff --git a/src/responder/nss/nsssrv_cmd.c b/src/responder/nss/nsssrv_cmd.c
index 80ac221e2..3c5d45071 100644
--- a/src/responder/nss/nsssrv_cmd.c
+++ b/src/responder/nss/nsssrv_cmd.c
@@ -4491,20 +4491,10 @@ static errno_t nss_cmd_getbysid_search(struct nss_dom_ctx *dctx)
 
     ret = sysdb_search_object_by_sid(cmdctx, dom, cmdctx->secid, NULL,
                                      &dctx->res);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to make request to our cache!\n");
-        return EIO;
-    }
-
-    if (dctx->res->count > 1) {
-        DEBUG(SSSDBG_FATAL_FAILURE, "getbysid call returned more than one " \
-                                     "result !?!\n");
-        return ENOENT;
-    }
-
-    if (dctx->res->count == 0) {
-        DEBUG(SSSDBG_OP_FAILURE, "No results for getbysid call.\n");
+    if (ret == ENOENT) {
         if (!dctx->check_provider) {
+            DEBUG(SSSDBG_OP_FAILURE, "No results for getbysid call.\n");
+
             /* set negative cache only if not result of cache check */
             ret = sss_ncache_set_sid(nctx->ncache, false, cmdctx->secid);
             if (ret != EOK) {
@@ -4513,6 +4503,15 @@ static errno_t nss_cmd_getbysid_search(struct nss_dom_ctx *dctx)
             }
         }
         return ENOENT;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to make request to our cache!\n");
+        return EIO;
+    }
+
+    if (dctx->res->count > 1) {
+        DEBUG(SSSDBG_FATAL_FAILURE, "getbysid call returned more than one " \
+                                     "result !?!\n");
+        return ENOENT;
     }
 
     /* if this is a caching provider (or if we haven't checked the cache
diff --git a/src/responder/pac/pacsrv_cmd.c b/src/responder/pac/pacsrv_cmd.c
index cc9259289..07d2f0cf7 100644
--- a/src/responder/pac/pacsrv_cmd.c
+++ b/src/responder/pac/pacsrv_cmd.c
@@ -297,17 +297,17 @@ static void pac_lookup_sids_done(struct tevent_req *req)
             msg = NULL;
             ret = sysdb_search_object_by_sid(pr_ctx, dom, entries[c].key.str,
                                              NULL, &msg);
-            if (ret != EOK) {
-                DEBUG(SSSDBG_OP_FAILURE, "sysdb_search_object_by_sid " \
-                                          "failed.\n");
+            if (ret == ENOENT) {
+                DEBUG(SSSDBG_OP_FAILURE, "No entry found for SID [%s].\n",
+                      entries[c].key.str);
+                continue;
+            } else if (ret != EOK) {
+                DEBUG(SSSDBG_OP_FAILURE,
+                      "sysdb_search_object_by_sid failed.\n");
                 continue;
             }
 
-            if (msg->count == 0) {
-                DEBUG(SSSDBG_OP_FAILURE, "No entry found for SID [%s].\n",
-                                          entries[c].key.str);
-                continue;
-            } else if (msg->count > 1) {
+            if (msg->count > 1) {
                 DEBUG(SSSDBG_CRIT_FAILURE, "More then one result returned " \
                                             "for SID [%s].\n",
                                             entries[c].key.str);
@@ -911,10 +911,13 @@ pac_store_membership(struct pac_req_ctx *pr_ctx,
 
     ret = sysdb_search_object_by_sid(tmp_ctx, grp_dom, grp_sid_str,
                                      group_attrs, &group);
-    if (ret != EOK) {
-        DEBUG(SSSDBG_TRACE_INTERNAL, "sysdb_search_object_by_sid " \
-                                      "for SID [%s] failed [%d][%s].\n",
-                                      grp_sid_str, ret, strerror(ret));
+    if (ret == ENOENT) {
+        DEBUG(SSSDBG_OP_FAILURE, "Unexpected number of groups returned.\n");
+        goto done;
+    } else if (ret != EOK) {
+        DEBUG(SSSDBG_TRACE_INTERNAL,
+              "sysdb_search_object_by_sid for SID [%s] failed [%d][%s].\n",
+              grp_sid_str, ret, strerror(ret));
         goto done;
     }