<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">There is the sss_cache command which should be able to handle this.<br>
But it lookus like it can handle everything BUT sudo rules :(<br>
Ondrej<br>
<div style="font-family: Times New Roman; color: #000000; font-size: 16px">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF714525"><font color="#000000" face="Tahoma" size="2"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Dimitar Georgievski [mitkany@gmail.com]<br>
<b>Sent:</b> Monday, December 23, 2013 4:16 PM<br>
<b>To:</b> Lukas Slebodnik<br>
<b>Cc:</b> freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] Sudo issues with FreeIPA<br>
</font><br>
</div>
<div></div>
<div>
<div dir="ltr">Hi Lukas,
<div><br>
</div>
<div>Does the LDAP entry need to be removed or just modified? Could the LDAP entry be a sudo policy assigned to the user? </div>
<div><br>
</div>
<div>In my tests with modified sudo policies the cache entries would persists even after they were invalidated and the user re-authenticated with the LDAP server. Unless I wanted to wait for a smart refresh of the cache I had to delete the entry from the cache
with ldbdel and then restart the SSSD daemon.</div>
<div><br>
</div>
<div>I wonder if there is a better way to refresh the cache on demand. </div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Dimitar</div>
<div><br>
</div>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Sat, Dec 21, 2013 at 3:28 PM, Lukas Slebodnik <span dir="ltr">
<<a href="mailto:lslebodn@redhat.com" target="_blank">lslebodn@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex">
<div class="im">On (20/12/13 18:42), Dimitar Georgievski wrote:<br>
>Hi Dmitri,<br>
><br>
>One follow up question about the management of the SSSD local cache. I've<br>
>tried to clean cache entries with the sss_cache utility, but it looks like<br>
>this utility is not working. I was able to confirm with ldbsearch that<br>
>records for specific entries were not removed from the cache.<br>
><br>
>This seems to be a bug. I can use ldpdel with a restart of the SSSD daemon,<br>
>but just wanted to confirm with you. I suspect you would know more about<br>
>this problem. Unfortunately I wasn't able to find any info yet about this<br>
>potential bug.<br>
><br>
>thanks<br>
><br>
>Dimitar<br>
><br>
</div>
sss_cache does not remove users from cache (sss_cache -U)<br>
This utility sets expiration of account to the past (unix time with value 1),<br>
because user needs to be able authenticate offline.<br>
Entry will be removed from cache if user try to<br>
authenticate online and entry is removed from LDAP.<br>
<span class="HOEnZb"><font color="#888888"><br>
LS<br>
</font></span></blockquote>
</div>
<br>
</div>
</div>
</div>
</div>
</body>
</html>