> Hi,
> 
> We have authentication running against the AD. We configured the
> cache_credentials option to be sure that login works if the AD fails.
>
> But when we disable an account in the AD, sssd is not updating his
> cache. When there is a connection between sssd and the AD, the user is
> still able to login.
>
> Is there an option to enable synchronization between the sssd cache
> and the AD?
>
>I need more information. This is ambiguous.
>
>First of all, do you have:
>access_provider = ldap
>ldap_access_order = expire
>ldap_account_expire_policy = ad
>
>
>Without this, I think we do not honor the disabled account policy.
>
>______________________________________________ >sssd-devel mailing list >sssd-devel@lists.fedorahosted.org >https://fedorahosted.org/mailman/listinfo/sssd-devel

Hi Stephen,

The options you described did the trick!!

Sorry for the ambigous email but it works now.

Thanx and regards