Hello,
I have had set up a test-bed environment consist of:

IPA server [master] - OL8.4
IPA server [replica] - OL8.4
IPA client1 - OL8.4
IPA client2 - OL8.4
IPA client3 - Ubuntu20.04LTS

//I've installed "master" manually and the rest of hosts via ansible playbooks.
All works fine: user created on IPA directory [let's say: "adminux"] can succesfully login on clients with SUDO priviliges.

Now I started to test offline [sssd] login ....and it works [too]fine => user can log into system even though it was disabled on IPA server!

I started to tune-up sssd.conf parameters:
------------------------------------------------------
root@cl3:~# vim /etc/sssd/sssd.conf

[domain/ux.example.com]

id_provider = ipa
ipa_server = _srv_, idm1.ux.example.com
ipa_domain = ux.example.com
ipa_hostname = cl3.ux.example.com
auth_provider = ipa
chpass_provider = ipa
access_provider = ipa
cache_credentials = True
ldap_tls_cacert = /etc/ipa/ca.crt
dyndns_update = True
dyndns_iface = ens33
krb5_store_password_if_offline = True


entry_cache_timeout = 60
account_cache_expiration = 1


[sssd]
services = nss, pam, ssh, sudo

domains = ux.example.com
[nss]
homedir_substring = /home

enum_cache_timeout = 10
entry_cache_nowait_percentage = 0

[pam]
pam_verbosity = 3
offline_credentials_expiration = 1
[sudo]

[sudo]

[autofs]

[ssh]

[pac]

[ifp]

[secrets]

[session_recording]
--------------------------------------------------

I was also trying to erase sssd cache with command:

#sss_cache -E

...but it doesn't work in my test env!

I'll appreciate any suggestions "How can I control off-line logon cache in case of user creation, user deletion, user rights change and so on..." ?

Regards,
m.


Sent with ProtonMail Secure Email.