10:26 a.m.
Hello,
I tried for some time to understand how the cache invalidation works on the clients, and I
have to admit that I am even more confused that when I started, therefore I would like to
ask if there is someone who can either explain or point me to the relevant documentation.
I'll describe bellow the situation I am currently facing:
PHASE 1
- RedHat Idm with AD trust configured (non-posix)
- override the UID of AD users in Idm
- on the clients run the id <username> ; the correct (overwritten ) UID and an
auto-generated GID is displayed
PHASE 2
- overwrite the GID as well on Idm
- on the clients still the old auto-generated GID is displayed (after sss_cache -E and
restart of sssd) when I run id <username>
- remove everything in /var/lib/sss/db , restart sssd and run id <username> - no
user found
- getent group <username> - new overwritten GID is displayed
- id <username> displays the correct UID and GID
For the users who are not in cache, restarting sssd seems to be enough (although I did not
test if thoroughly).
My question is :
What do I have to do on the client in order to have the latest information from the Idm
Override ? Apparently sss_cache -E and restart ssssd is not enough .
Do we always need to remove everything in /var/lib/sss/db in order to have the latest
information from the server ?
9:33 a.m.
Hi,
SSSD is also using a memory cache, and you need to remove the files in
/var/lib/sss/mc/ in order to clean it. Its lifetime and size can also be
set in sssd.conf, please look for memcache_* in sssd.conf man page.
flo
On Fri, Jun 25, 2021 at 5:28 PM iulian roman via FreeIPA-users <
freeipa-users(a)lists.fedorahosted.org> wrote:
Hello,
I tried for some time to understand how the cache invalidation works on
the clients, and I have to admit that I am even more confused that when I
started, therefore I would like to ask if there is someone who can either
explain or point me to the relevant documentation.
I'll describe bellow the situation I am currently facing:
PHASE 1
- RedHat Idm with AD trust configured (non-posix)
- override the UID of AD users in Idm
- on the clients run the id <username> ; the correct (overwritten ) UID
and an auto-generated GID is displayed
PHASE 2
- overwrite the GID as well on Idm
- on the clients still the old auto-generated GID is displayed (after
sss_cache -E and restart of sssd) when I run id <username>
- remove everything in /var/lib/sss/db , restart sssd and run id
<username> - no user found
- getent group <username> - new overwritten GID is displayed
- id <username> displays the correct UID and GID
For the users who are not in cache, restarting sssd seems to be enough
(although I did not test if thoroughly).
My question is :
What do I have to do on the client in order to have the latest information
from the Idm Override ? Apparently sss_cache -E and restart ssssd is not
enough .
Do we always need to remove everything in /var/lib/sss/db in order to have
the latest information from the server ?
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it:
https://pagure.io/fedora-infrastructure
8:36 a.m.
Hi Florence,
I removed the files in that location , although sss_cache -E seems to do that as well. The
behaviour hasn't changed unfortunately.
8:55 a.m.
Hi,
On Fri, Jun 25, 2021 at 5:27 PM iulian roman via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
Hello,
I tried for some time to understand how the cache invalidation works on the clients, and
I have to admit that I am even more confused that when I started, therefore I would like
to ask if there is someone who can either explain or point me to the relevant
documentation.
I'll describe bellow the situation I am currently facing:
PHASE 1
- RedHat Idm with AD trust configured (non-posix)
- override the UID of AD users in Idm
- on the clients run the id <username> ; the correct (overwritten ) UID and an
auto-generated GID is displayed
PHASE 2
- overwrite the GID as well on Idm
- on the clients still the old auto-generated GID is displayed (after sss_cache -E and
restart of sssd) when I run id <username>
There are cases where you need to run "sss_cache -E" on the server as
well. That might be it.
- remove everything in /var/lib/sss/db , restart sssd and run id
<username> - no user found
This could be a timeout. The client requests the information from the
server which does not reply within the timeout value.
Since there is no entry in the SSSD cache, the only possible outcome
is "no user found".
Set SSSD in debug mode, level 9:
https://docs.pagure.org/sssd.sssd/users/troubleshooting.html
on both IDM server and IDM client, restart sssd on both and you will
see what happens more clearly.
You might want to adjust timeouts so that this does not happen, but do
not set them too high either.
- getent group <username> - new overwritten GID is displayed
- id <username> displays the correct UID and GID
For the users who are not in cache, restarting sssd seems to be enough (although I did
not test if thoroughly).
My question is :
What do I have to do on the client in order to have the latest information from the Idm
Override ? Apparently sss_cache -E and restart ssssd is not enough .
Do we always need to remove everything in /var/lib/sss/db in order to have the latest
information from the server ?
From the man page, this should help: sss_cache -u <user>
HTH
François
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
9:24 a.m.
Hi,
Hi,
On Fri, Jun 25, 2021 at 5:27 PM iulian roman via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
There are cases where you need to run "sss_cache -E" on the server as
well. That might be it.
I run it as well on both IPA servers , restarted sssd, sss_cache -u , etc.
This could be a timeout. The client requests the information from the
server which does not reply within the timeout value.
It can be, but what are the values/variables which need to be adjusted ?
Since there is no entry in the SSSD cache, the only possible outcome
is "no user found".
Set SSSD in debug mode, level 9:
https://docs.pagure.org/sssd.sssd/users/troubleshooting.html
on both IDM server and IDM client, restart sssd on both and you will
see what happens more clearly.
I enabled for domain, nss, ssd on both ipa client
and servers and tried to connect the dots. It seems to be related to that private group (I
opened a new thread for that issue)
> You might want to adjust timeouts so that this does not happen, but do
> not set them too high either.
>
>
> From the man page, this should help: sss_cache -u <user>
>
> HTH
> François
1024
days inactive
1028
days old
freeipa-users@lists.fedorahosted.org
4 comments
3 participants
participants (3)
-
Florence Renaud -
François Cami -
iulian roman