[SSSD] Ldap question: How to quickly see changes to a user's group list.

Stephen Gallagher sgallagh at redhat.com
Tue Mar 25 12:25:50 UTC 2014


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/25/2014 06:14 AM, steve wrote:
> On Mon, 2014-03-24 at 22:36 -0400, Mark London wrote:
>> Hi - We are running an LDAP server on a Windows box.  We have a
>> need for our Linux clients to be able to quickly see 
>> modifications we make to a user's account, i.e. adding a group to
>> an account. The only way that I've found to be able to do this,
>> is to set ldap_enumeration_refresh_timeout to a small amount of
>> time.  Is there a better way to do this (that uses less cpu)?
>> Thanks. - Mark
> 
> Hi sss_cache -UG

This is only useful on event-driven behavior.


> should get you there. If not and you get desperate, rm the files
> at: /var/lib/sss/db/* and restart.

Be careful about doing this; it will wipe out any cached credentials
on the system.


> Make sure that nscd is not running. HTH Steve
> 


Mark, how do your lookups happen? Are you really relying on
'getgrent()' calls to get group information? If so, you really don't
have any choice; lowering the enum time is the best you can do.

If what you really mean is "When I make a change, I want newly
logged-in users to have that change immediately reflected.", that's a
different question (and one that you will be happy to know is already
handled for you).

The cache refresh timeouts exist entirely for the support of
'getpwnam()', 'getgrent()' and friends. But SSSD also does a forced
cache update of any groups to which the user belongs as part of the
authentication phase.

So whenever a user logs in, SSSD will first do a full refresh of the
user object and all associated group objects, *then* perform the
login. In other words, as long as SSSD could access LDAP at login
time, any logged-in user will always be assigned the group memberships
present in LDAP. (*)


So before we can realistically answer your original question, we need
to know more about the specific use case that you are trying to address.


(*) Special note: a limitation of UNIX/LINUX is that if the user's
group membership changes while they are logged in, that change will
not take effect on that session; it will only happen on next login.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iEYEARECAAYFAlMxdc4ACgkQeiVVYja6o6ObGwCfd64xlHIyKmJdmMz6d1oxjbJo
eHwAniMemLvlRFJ4a8LQubw8j9aUazBg
=h28T
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list