[SSSD] Cached user info?

Jan Zelený jzeleny at redhat.com
Mon May 14 07:28:41 UTC 2012


> On 5/11/12 10:22 AM, Stephen Gallagher wrote:
> > On Fri, 2012-05-11 at 10:19 -0400, Braden McDaniel wrote:
> >> As I mentioned at the top of the thread, I changed the local group GID
> >> on the Fedora 16 installation to 989 (from 990) to match the Fedora 17
> >> installation.  Things appear to be working fine on the Fedora 16
> >> installation.  (But it occurs to me that if I were to try to join a new
> >> group with GID 990 on the Fedora 16 installation, I might see things go
> >> squirrelly there, too.)
> >> 
> >> Should I have removed the local mock group on both installations?
> > 
> > Yes, if you're maintaining it in LDAP, you should remove it locally.
> > Otherwise, the client system will never ask LDAP for it. (It always
> > checks the local files first, and ignores LDAP if it's found locally).
> 
> Okay, does this apply across the board?  In particular, what about a
> group like "users"?  groupdel tells me I can't just delete it because
> "games" is a member.  Do I need to maintain the "games" user in LDAP as
> well?  Or should I instead be finding a way to force removal of the
> local "users" group?

That depends on the order in your nsswitch.conf. If you have files before sss 
then yes, every lookup will go to files first and fall back to sss only if the 
record is not in files.

> Maintaining the "games" user in LDAP, while certainly conceivable, just
> strikes me as a little unintuitive since it's not a "regular" user.

My choice would be to delete the group users from LDAP. But this decision is 
up to you and depends on whole lot of things I guess. For example on IPA 
server there is a group "ipausers" containing all users that are on the 
server. Perhaps you should consider similar solution?

Jan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part.
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20120514/f22478b2/attachment.sig>


More information about the sssd-devel mailing list