I have had set up a test-bed environment consist of:

IPA server [master] - OL8.4
IPA server [replica] - OL8.4
IPA client1 - OL8.4
IPA client2 - OL8.4
IPA client3 - Ubuntu20.04LTS

//I've installed "master" manually and the rest of hosts via ansible playbooks.
All works fine: user created on IPA directory [let's say: "adminux"] can succesfully login on clients with SUDO priviliges.

Now I started to test offline [sssd] login ....and it works [too]fine => user can log into system even though it was disabled on IPA server!

I started to tune-up sssd.conf parameters:
root@cl3:~# vim /etc/sssd/sssd.conf


id_provider = ipa
ipa_server = _srv_, idm1.ux.example.com
ipa_domain = ux.example.com
ipa_hostname = cl3.ux.example.com
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
dyndns_update = True
dyndns_iface = ens33
krb5_store_password_if_offline = True

entry_cache_timeout = 60
account_cache_expiration = 1

services = nss, pam, ssh, sudo

domains = ux.example.com
homedir_substring = /home

enum_cache_timeout = 10
entry_cache_nowait_percentage = 0

pam_verbosity = 3
offline_credentials_expiration = 1








I was also trying to erase sssd cache with command:

#sss_cache -E

...but it doesn't work in my test env!

I'll appreciate any suggestions "How can I control off-line logon cache in case of user creation, user deletion, user rights change and so on..." ?


Sent with ProtonMail Secure Email.