[SSSD] remove nisNetgroupTriple or memberNisNetgroup from server bug sssd did not reflect it.

Dmitri Pal dpal at redhat.com
Fri Jan 6 22:39:11 UTC 2012


On 01/05/2012 08:31 PM, Joe Jin wrote:
> On 01/05/12 22:07, Jakub Hrozek wrote:
>> On Thu, Jan 05, 2012 at 12:33:24PM +0800, Joe Jin wrote:
>>> On 01/05/12 11:43, Stephen Gallagher wrote:
>>>> On Thu, 2012-01-05 at 11:26 +0800, Joe Jin wrote:
>>>>> Hi,
>>>>>
>>>>> When I did sssd + openLDAP tests I found if remove nisNetgroupTriple or 
>>>>> memberNisNetgroup attribute, sssd did not reflected the changed, 
>>>>> "getent netgroup <group_name>" return unchanged result.
>>>> Did you wait for the entry_cache_timeout period? Cached entries aren't
>>>> updated instantaneously.
>>> Yes I did, I set entry_cache_timeout to 120s, when I add new entry to
>>> nisNetgroupTriple or memberNisNetgroup, it updated in 120s, but if I
>>> removed any one of the attributes, getent still return former result,
>>> even after more than 120s.
>>>  
>> Sorry I could not reproduce that behaviour - neither with master nor 6.2
>>
> Thanks for your reply, I reproduce the issue by below:
> 1. Create nisNetGroup with some nisNetgroupTriple entries on ldap server,
>    on client getent show all.
> 2. Deleted all nisNetgroupTriple entries on ldap server -- means should deleted
>    the attribute, run getent again,    even after @entry_cache_timeout(120s), 
>    getent still show all triples before deleted the attribute.
> 3. If I just remove one or more nisNetgroupTriple entries rather delete all,
>    getent show correct result after a while.
>
> Regarding memberNisNetgroup, if I deleted all entries, getent result not updated,
> but if I just delete one or more but not of all, getent result is correct.
>

Do not have a code in front of me that this sounds like a bug in the
error handling of the empty list.
It seems that if the list is not empty the cache is reconciled by if the
content of the netgroup is empty it chooses a different code path rather
than reconciling the content of the group.

Stephen, Jakub can you please check my theory?

>> One twist is that the cache expiry time is saved into the cache so if
>> you save an item, then change the entry_cache_timeout, the entry keeps
>> its original expiry timeout.
>>
>> I would recommend to purge the cache altogether (or at least the netgroup
>> items) if you need to reflect a changed entry_cache_timeout value.
> I think I have set it? below is my sssd.conf 
>
> [sssd]
> debug_level = 10 
> domains = LDAP
> config_file_version = 2
> reconnection_retries = 3
> sbus_timeout = 30
> services = nss, pam
>
> [nss]
> reconnection_retries = 3
>
> [pam]
> reconnection_retries = 3
>
> [domain/LDAP]
> enumerate = true
> cache_credentials = FALSE
> id_provider = ldap
> auth_provider = ldap
> chpass_provider = ldap
> entry_cache_timeout = 120
> ldap_schema = rfc2307
> ldap_uri = ldaps://<LDAP_SERVER>
> ldap_search_base = ou=Netgroup,dc=example,dc=com
> ldap_id_use_start_tls = true
> ldap_tls_reqcert = allow
> ldap_tls_cacertdir = /etc/openldap/cacerts
> ldap_tls_cacert = /etc/openldap/cacerts/client.cert
> ldap_default_bind_dn = cn=jimbob,dc=example,dc=com
> ldap_default_authtok = <password>
> ldap_user_object_class = inetOrgPerson
> ldap_user_name = uid
> ldap_user_uid_number = uidNumber
> ldap_user_gid_number = gidNumber
> ldap_user_home_directory = homeDirectory
> ldap_user_shell = loginShell
> ldap_purge_cache_timeout = 10
> ldap_group_object_class = *
>
>
> Thanks,
> Joe
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IPA project,
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list