[SSSD] Cached user info?
Jan Zelený
jzeleny at redhat.com
Mon May 14 07:28:41 UTC 2012
> On 5/11/12 10:22 AM, Stephen Gallagher wrote:
> > On Fri, 2012-05-11 at 10:19 -0400, Braden McDaniel wrote:
> >> As I mentioned at the top of the thread, I changed the local group GID
> >> on the Fedora 16 installation to 989 (from 990) to match the Fedora 17
> >> installation. Things appear to be working fine on the Fedora 16
> >> installation. (But it occurs to me that if I were to try to join a new
> >> group with GID 990 on the Fedora 16 installation, I might see things go
> >> squirrelly there, too.)
> >>
> >> Should I have removed the local mock group on both installations?
> >
> > Yes, if you're maintaining it in LDAP, you should remove it locally.
> > Otherwise, the client system will never ask LDAP for it. (It always
> > checks the local files first, and ignores LDAP if it's found locally).
>
> Okay, does this apply across the board? In particular, what about a
> group like "users"? groupdel tells me I can't just delete it because
> "games" is a member. Do I need to maintain the "games" user in LDAP as
> well? Or should I instead be finding a way to force removal of the
> local "users" group?
That depends on the order in your nsswitch.conf. If you have files before sss
then yes, every lookup will go to files first and fall back to sss only if the
record is not in files.
> Maintaining the "games" user in LDAP, while certainly conceivable, just
> strikes me as a little unintuitive since it's not a "regular" user.
My choice would be to delete the group users from LDAP. But this decision is
up to you and depends on whole lot of things I guess. For example on IPA
server there is a group "ipausers" containing all users that are on the
server. Perhaps you should consider similar solution?
Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120514/f22478b2/attachment.sig>
More information about the sssd-devel
mailing list