[SSSD] remove nisNetgroupTriple or memberNisNetgroup from server bug sssd did not reflect it.

Joe Jin joe.jin at oracle.com
Fri Jan 6 01:31:31 UTC 2012


On 01/05/12 22:07, Jakub Hrozek wrote:
> On Thu, Jan 05, 2012 at 12:33:24PM +0800, Joe Jin wrote:
>> On 01/05/12 11:43, Stephen Gallagher wrote:
>>> On Thu, 2012-01-05 at 11:26 +0800, Joe Jin wrote:
>>>> Hi,
>>>>
>>>> When I did sssd + openLDAP tests I found if remove nisNetgroupTriple or 
>>>> memberNisNetgroup attribute, sssd did not reflected the changed, 
>>>> "getent netgroup <group_name>" return unchanged result.
>>>
>>> Did you wait for the entry_cache_timeout period? Cached entries aren't
>>> updated instantaneously.
>>
>> Yes I did, I set entry_cache_timeout to 120s, when I add new entry to
>> nisNetgroupTriple or memberNisNetgroup, it updated in 120s, but if I
>> removed any one of the attributes, getent still return former result,
>> even after more than 120s.
>>  
> 
> Sorry I could not reproduce that behaviour - neither with master nor 6.2
> 
Thanks for your reply, I reproduce the issue by below:
1. Create nisNetGroup with some nisNetgroupTriple entries on ldap server,
   on client getent show all.
2. Deleted all nisNetgroupTriple entries on ldap server -- means should deleted
   the attribute, run getent again,    even after @entry_cache_timeout(120s), 
   getent still show all triples before deleted the attribute.
3. If I just remove one or more nisNetgroupTriple entries rather delete all,
   getent show correct result after a while.

Regarding memberNisNetgroup, if I deleted all entries, getent result not updated,
but if I just delete one or more but not of all, getent result is correct.


> One twist is that the cache expiry time is saved into the cache so if
> you save an item, then change the entry_cache_timeout, the entry keeps
> its original expiry timeout.
> 
> I would recommend to purge the cache altogether (or at least the netgroup
> items) if you need to reflect a changed entry_cache_timeout value.

I think I have set it? below is my sssd.conf 

[sssd]
debug_level = 10 
domains = LDAP
config_file_version = 2
reconnection_retries = 3
sbus_timeout = 30
services = nss, pam

[nss]
reconnection_retries = 3

[pam]
reconnection_retries = 3

[domain/LDAP]
enumerate = true
cache_credentials = FALSE
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
entry_cache_timeout = 120
ldap_schema = rfc2307
ldap_uri = ldaps://<LDAP_SERVER>
ldap_search_base = ou=Netgroup,dc=example,dc=com
ldap_id_use_start_tls = true
ldap_tls_reqcert = allow
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_cacert = /etc/openldap/cacerts/client.cert
ldap_default_bind_dn = cn=jimbob,dc=example,dc=com
ldap_default_authtok = <password>
ldap_user_object_class = inetOrgPerson
ldap_user_name = uid
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = homeDirectory
ldap_user_shell = loginShell
ldap_purge_cache_timeout = 10
ldap_group_object_class = *


Thanks,
Joe



More information about the sssd-devel mailing list