[SSSD] remove nisNetgroupTriple or memberNisNetgroup from server bug sssd did not reflect it.

Joe Jin joe.jin at oracle.com
Thu Jan 5 04:33:24 UTC 2012


On 01/05/12 11:43, Stephen Gallagher wrote:
> On Thu, 2012-01-05 at 11:26 +0800, Joe Jin wrote:
>> Hi,
>>
>> When I did sssd + openLDAP tests I found if remove nisNetgroupTriple or 
>> memberNisNetgroup attribute, sssd did not reflected the changed, 
>> "getent netgroup <group_name>" return unchanged result.
> 
> Did you wait for the entry_cache_timeout period? Cached entries aren't
> updated instantaneously.

Yes I did, I set entry_cache_timeout to 120s, when I add new entry to
nisNetgroupTriple or memberNisNetgroup, it updated in 120s, but if I
removed any one of the attributes, getent still return former result,
even after more than 120s.
 
> 
> What version of SSSD are you running?

sssd-1.5.1-66.0.1.el6.x86_64 from RHEL6U2.

> 
>>
>> Timeout have been set and it works as exception.
>>
> 
> Can you please rephrase this? I have no idea what timeout or exception
> you mean.

I seen sssd will sync with ldap server in @entry_cache_timeout

> 
>> I found when save user to local database, it will check missing attrs,
>> if lost then remove them, but when save group info to local database
>> sssd did not check this at all, any idea for this?
> 
> What group attrs are you talking about?

See below call path:
in sdap_save_user() it call list_missing_attrs() and get missing attrs, then in 
sysdb_store_user(), it remove missing attrs by sysdb_remove_attrs, but for 
group, no such checks.

Thanks,
Joe



More information about the sssd-devel mailing list