[SSSD] sssd caching

Stephen Gallagher sgallagh at redhat.com
Mon Nov 14 13:16:27 UTC 2011


On Mon, 2011-11-14 at 09:52 +0100, Thomas Jagt wrote:
> Hi,
> 
> We have authentication running against the AD. We configured the
> cache_credentials option to be sure that login works if the AD fails.
> 
> But when we disable an account in the AD, sssd is not updating his
> cache. When there is a connection between sssd and the AD, the user is
> still able to login.
> 
> Is there an option to enable synchronization between the sssd cache
> and the AD?


I need more information. This is ambiguous.

First of all, do you have:
access_provider = ldap
ldap_access_order = expire
ldap_account_expire_policy = ad


Without this, I think we do not honor the disabled account policy.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20111114/8d4e201a/attachment.sig>


More information about the sssd-devel mailing list