Hello,
I'am a new FreeIPA user and most things are working fine, except when I update a user on the IPA server the client does not update it's information.
Greetings,
Lucas
Hi,
On Thu, Aug 11, 2022 at 10:38 AM Lucas Blom via FreeIPA-devel < freeipa-devel@lists.fedorahosted.org> wrote:
Hello,
I'am a new FreeIPA user and most things are working fine,
Welcome to the community! For troubleshooting or help requests, the mailing list freeipa-users https://lists.fedoraproject.org/archives/list/freeipa-users@lists.fedorahosted.org/ is probably a better avenue.
except when I update a user on the IPA server the client does not update
it's information.
Can you share more details on the steps you're taking to showcase the issue? Which command are you executing on the client side, what is the actual output versus what you would expect? flo
Greetings,
Lucas _______________________________________________ FreeIPA-devel mailing list -- freeipa-devel@lists.fedorahosted.org To unsubscribe send an email to freeipa-devel-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-devel@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
Hi,
So what I did was: 1. I changed the group of an account using the IPA web interface. 2. I verified the change on the server terminal using "id <username>" and I got the updated information. 3. I tried to verify the update on the client side by issuing the same command "id <username>" but this time I got the old information.
Hope this clears up my situation,
Lucas
On ti, 16 elo 2022, Lucas Blommers via FreeIPA-devel wrote:
Hi,
So what I did was:
- I changed the group of an account using the IPA web interface.
- I verified the change on the server terminal using "id <username>" and I got the updated information.
- I tried to verify the update on the client side by issuing the same command "id <username>" but this time I got the old information.
Thanks for describing your use case. In general, group membership for a user is updated by SSSD at authentication time when that user logs into the system in question. This is because once logged in, a set of supplementary groups a process running under the user account will have is fixed and cannot be changed without starting a different session. This is pretty much the same for all networking software that provides a remote group membership capabilities through nsswitch interface on Linux and UNIX-like systems. Discovering updates to group membership is in general not easy without actual authentication being done.
There are various settings in SSSD to affect an entry cache that may force a cached entry for the user be refreshed (leading to group updates). Please see man page for sssd.conf(5) in domain section.
freeipa-devel@lists.fedorahosted.org
-
Alexander Bokovoy -
Florence Blanc-Renaud -
Lucas Blom -
Lucas Blommers