On Пан, 23 кас 2023, Rob Crittenden via FreeIPA-users wrote:
Alper AYKUT via FreeIPA-users wrote:
> On my free ipa server, I can still see the ldapuser02 user that I
> deleted from the free ipa web interface with the following command, what
> could be the reason for this?
>
> [root@idm /]# id ldapuser02
> uid=168200020(ldapuser02) gid=168200020(ldapuser02)
> groups=168200020(ldapuser02)
>
> id aykut
> uid=168200021(aykut) gid=168200021(aykut) groups=168200021(aykut)
>
> ipa user-del aykut
> ipa: ERROR: aykut: user not found
>
> ipa user-del ldapuser02
> ipa: ERROR: ldapuser02: user not found
>
> With the user del command, although there are no users, the ids of the
> users appear. how can I update this? where should I check?
SSSD caches data. You can use sss_cache(8) to refresh things. For
example, sss_cache -u aykut
In addition, sss_cache only marks an entry as invalidated but does not
clean up it from the local cache database.
User information is updated by SSSD at the user's login time. Typically
the fact that IDs exist before login is not considered a problem because
no processes are running under that ID (and thus cannot change files).
You can set up caching properties to remove entries at a specific time.
This is covered in man page for sssd-ldap(5):
ldap_purge_cache_timeout (integer)
Determine how often to check the cache for inactive entries
(such as groups with no members and users who have never
logged in) and remove them to save space.
Setting this option to zero will disable the cache cleanup
operation. Please note that if enumeration is enabled, the
cleanup task is required in order to detect entries removed
from the server and can't be disabled. By default, the
cleanup task will run every 3 hours with enumeration enabled.
This option can be also set per subdomain or inherited via
subdomain_inherit.
Default: 0 (disabled)
(In IPA environments enumeration is disabled by default).
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland