On 01/05/12 22:07, Jakub Hrozek wrote:
On Thu, Jan 05, 2012 at 12:33:24PM +0800, Joe Jin wrote:
> On 01/05/12 11:43, Stephen Gallagher wrote:
>> On Thu, 2012-01-05 at 11:26 +0800, Joe Jin wrote:
>>> Hi,
>>>
>>> When I did sssd + openLDAP tests I found if remove nisNetgroupTriple or
>>> memberNisNetgroup attribute, sssd did not reflected the changed,
>>> "getent netgroup <group_name>" return unchanged result.
>>
>> Did you wait for the entry_cache_timeout period? Cached entries aren't
>> updated instantaneously.
>
> Yes I did, I set entry_cache_timeout to 120s, when I add new entry to
> nisNetgroupTriple or memberNisNetgroup, it updated in 120s, but if I
> removed any one of the attributes, getent still return former result,
> even after more than 120s.
>
Sorry I could not reproduce that behaviour - neither with master nor 6.2
Thanks for your reply, I reproduce the issue by below:
1. Create nisNetGroup with some nisNetgroupTriple entries on ldap server,
on client getent show all.
2. Deleted all nisNetgroupTriple entries on ldap server -- means should deleted
the attribute, run getent again, even after @entry_cache_timeout(120s),
getent still show all triples before deleted the attribute.
3. If I just remove one or more nisNetgroupTriple entries rather delete all,
getent show correct result after a while.
Regarding memberNisNetgroup, if I deleted all entries, getent result not updated,
but if I just delete one or more but not of all, getent result is correct.
One twist is that the cache expiry time is saved into the cache so
if
you save an item, then change the entry_cache_timeout, the entry keeps
its original expiry timeout.
I would recommend to purge the cache altogether (or at least the netgroup
items) if you need to reflect a changed entry_cache_timeout value.
I think I have set it? below is my sssd.conf
[sssd]
debug_level = 10
domains = LDAP
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam
[nss]
reconnection_retries = 3
[pam]
reconnection_retries = 3
[domain/LDAP]
enumerate = true
cache_credentials = FALSE
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
entry_cache_timeout = 120
ldap_schema = rfc2307
ldap_uri = ldaps://<LDAP_SERVER>
ldap_search_base = ou=Netgroup,dc=example,dc=com
ldap_id_use_start_tls = true
ldap_tls_reqcert = allow
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/client.cert
ldap_default_bind_dn = cn=jimbob,dc=example,dc=com
ldap_default_authtok = <password>
ldap_user_object_class = inetOrgPerson
ldap_user_name = uid
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_purge_cache_timeout = 10
ldap_group_object_class = *
Thanks,
Joe