[SSSD] debbuging, how to turn off cache [SOLVED]
steve
steve at steve-ss.com
Thu Apr 18 11:13:17 UTC 2013
On 04/18/2013 11:30 AM, John Hodrien wrote:
> On Thu, 18 Apr 2013, steve wrote:
>
>> Having the user login has no effect. getent still shows him as
>> memberOf (he appears alongside his now primary group and not, as
>> should happen, alongside his secondary group).
>
> Perhaps I was misunderstanding. I thought you were changing a user's
> primary
> group, and weren't seeing that updated. I'd expect you to have to
> wait to the
> cache to clear, or do:
>
> sss_cache -u thatuser
>
> Maybe I was misunderstanding what you're trying to do.
>
>>> Can I just query one thing? Why on earth are you changing user
>>> attributes
>>> for users so frequently?
>
>> Yes. Thanks. We have to justify from winbind, nslcd or sssd for a
>> situation where 600 users can login to any one of around 80 machines
>> in a Samba4 domain. Adding/removing a user to a group is quite
>> common. This is not recognised on the clients unless root intervenes:
>> Impossible! Less common, but common enough in our environment is
>> moving a user's home directory.
>
> It's not recognised on the clients until the cache expires, but I
> don't see
> how that can not be the case. This'd also be the case with windows,
> where the
> user's PAC will be used to verify group membership, which often means
> forcing
> a user to log off and back on again to update group membership.
>
>> We've eliminated winbind and are left with nslcd which is time
>> consuming to implement (but which passes all the tests), and sssd
>> with it's point and click configuration. We'd really like to go with
>> sssd but we have to prove in a test lab that what we do will be
>> covered. We simply have to maintain the domain centrally. We cannot
>> visit 80 clients everytime a change is made.
>
> Group membership changes propogate in our environment just fine within a
> reasonable period of time. What should we be talking by default, 5
> minutes?
Hi
OK. I've just removed a user from a group and logged in as that user.
After 30 minutes id, getent and tests on what he can access still show
him to be a member. That's too long.
Could you do me a big favour and have a look at our client conf?
[sssd]
services = nss, pam
config_file_version = 2
domains = default
[nss]
[pam]
[domain/default]
ldap_schema = rfc2307bis
access_provider = simple
enumerate = FALSE
cache_credentials = true
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
krb5_realm = DOLORES.SITE
krb5_server = doloresdc.dolores.site
krb5_kpasswd = doloresdc.dolores.site
ldap_uri = ldap://doloresdc.dolores.site
ldap_search_base = dc=dolores,dc=site
#ldap_tls_cacertdir = /usr/local/samba/private/tls
#ldap_id_use_start_tls = true
ldap_user_object_class = user
ldap_user_name = samAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_home_directory = unixHomeDirectory
ldap_user_shell = loginShell
ldap_group_object_class = group
ldap_group_search_base = dc=dolores,dc=site
ldap_group_name = cn
ldap_group_member = member
ldap_user_search_filter =(&(objectCategory=User)(uidNumber=*))
ldap_sasl_mech = gssapi
ldap_sasl_authid = ALGORFA$
ldap_krb5_keytab = /etc/krb5.keytab
ldap_krb5_init_creds = true
Cheers
More information about the sssd-devel
mailing list