Title: #390: NSS: Add option to disable memcache
On (25/09/17 07:23), sumit-bose wrote:
I think adding to option to the man page is the only way to make sure
the negative impact of this option is properly documented and nobody can be hit by the
effects of the option by surprise (I know nobody reads man pages but that's a
different story). Additionally this way we can underline that this option should not be
used in production but only for testing or to temporarily work around an issues until it
I do not agree, If we do not document anything and do not advertise it then
people will not use it. This option does not have any reasonable use-case.
You can already use `SSS_NSS_USE_MEMCACHE` + systemd for that purpose.
Moreover, problematic customer does not have a problem with memory cache.
because it was explained many times that even though some application(postfix)
clean environment variables and (thus also SSS_NSS_USE_MEMCACHE) then such
application will never cause issue with opened fd to removed mc files.
postfix will do many request to sssd and therefore sssd-client will reopen
fresh mc files. So customer does not have any reasonable request for disabling
memory cache. They just want that because they want and they are big.
However they are fine with systemd workaround but they want to disable
memory cache on el6 and el5. And it it obvious that memory cache is not they
main problem because they didn't even test it properly. (el5 does not have
memory cache). And el6 does not have an init system which would call
getpwnam/getgrnam/initgroups for each service user session.
So their main problem is that authentication is denied with full /var.
See the full comment at https://github.com/SSSD/sssd/pull/390#issuecomment-331826630