Title: #806: sudo: always use server highest usn for smart refresh
I see. So if enumeration is disabled we are stuck in the same
situation as we are now.
Yes, that's my finding as well. Using the patch for sdap_steal_server_opts() helps to
mitigate this by refreshing last_usn at least on every reconnect. The alternative would be
to read lastUSN from the rootDSE explicitly with every smart refresh.
See the full comment at https://github.com/SSSD/sssd/pull/806#issuecomment-489967231