This new sssd version for RHEL7  (sssd-1.16.5-10.el7_9.11)  fixes a bug we’ve seen in sssd.  This bug:  .   (Thanks, Sumit!)

We’ve verified this bugfix – that it only auto-discovers the expected domains now, not the extra domains that it shouldn’t discover.   So how best to roll out this new bugfixed sssd version?   (We do “no downtime” OS patching + kernel splicing monthly, so we try to be gentle in our monthly patching.)

Right now,  the following domains have been auto-discovered:


[root@spikeol73canbo yum.repos.d]# sssctl domain-list





[root@spikeol73canbo yum.repos.d]#


Only the top 5 AD domains are good domains that should be discovered.


When I yum upgrade to this new good sssd version all the above domains are still cached.   Even if I do ‘sssctl cache-expire -E’, these cached bogus domains still are not cleaned up.  If I aggressively clear the sssd cache as so:


systemctl stop sssd

cd /var/lib/sss

rm -rf db/*

rm -f /mc/*

systemctl start sssd


that clears the cache.  But that’s pretty invasive to push out as part of monthly patching.   

1.        Is there a kinder, gentler way to expire these bogus cached AD domains?  Along the lines of sssctl cache-expire -E or sssctl cache-expire -d <bogus domain>?

2.       If we let this new sssd version sit for 1-2 days, will these bogus auto-discovered AD domains auto-expire from cache on their own?