<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /></head><body style='font-size: 10pt; font-family: Verdana,Geneva,sans-serif'>
<p>Hey,</p>
<p>Is that the sssd configuration on the server or the client? There's no sss_cache executable on the client; is that correct?</p>
<p>I noticed that when I remove a user from the sudo role, the clients notice it almost immediately, but when I readd the sudo role, it doesn't come back. I usually have to restart sssd on the client. I tried setting entry_cache_timeout on the client to 60 and even setting cache_credentials to false, but those don't seem to have changed anything. For reference, here's part of the sssd.conf on the client:</p>
<p style="padding-left: 30px;"><span style="font-family: courier new,courier,monospace;">[domain/ipa.services.FOO]</span><br /><br /><span style="font-family: courier new,courier,monospace;">cache_credentials = False</span><br /><span style="font-family: courier new,courier,monospace;">krb5_store_password_if_offline = True</span><br /><span style="font-family: courier new,courier,monospace;">ipa_domain = ipa.services.FOO</span><br /><span style="font-family: courier new,courier,monospace;">id_provider = ipa</span><br /><span style="font-family: courier new,courier,monospace;">auth_provider = ipa</span><br /><span style="font-family: courier new,courier,monospace;">access_provider = permit</span><br /><span style="font-family: courier new,courier,monospace;">ldap_tls_cacert = /etc/ipa/ca.crt</span><br /><span style="font-family: courier new,courier,monospace;">ipa_hostname = 10.100.15.40</span><br /><span style="font-family: courier new,courier,monospace;">chpass_provider = ipa</span><br /><span style="font-family: courier new,courier,monospace;">ipa_server = _srv_, ipa.services.FOO</span><br /><span style="font-family: courier new,courier,monospace;">dns_discovery_domain = ipa.services.FOO</span><br /><span style="font-family: courier new,courier,monospace;">entry_cache_timeout = 60</span></p>
<p>Am I doing something wrong here?</p>
<p><br /></p>
<p>On 2017-04-06 03:11, Martin Bašti wrote:</p>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<div class="pre" style="margin: 0; padding: 0; font-family: monospace"><br /><br /><span style="white-space: nowrap;">On 06.04.2017 01:57, Greg Gilbert wrote:</span>
<blockquote type="cite" style="padding: 0 0.4em; border-left: #1010ff 2px solid; margin: 0">Hey. I'm a bit new to FreeIPA, so apologies if this has already been addressed. For reference, I'm running FreeIPA 4.4 server on CentOS 7, and FreeIPA client 4.3.1 on Ubuntu nodes.<br /><br /> I've noticed that when I make changes to policies, it either takes a long time to propagate out to the client nodes, or requires a manual restart of the sssd service. In this case, I'm testing adding and removing a user from a sudo rule. Is this the correct behavior, or is there a misconfiguration on my part somewhere?<br /><br /><span style="white-space: nowrap;">- greg</span><br /><br /></blockquote>
<br /><span style="white-space: nowrap;">Hello,</span><br /><br /> it is caused by SSSD caches, to refresh particular objects in cache see `man sss_cache`.<br /><br /> You can lower TTL for records in cache, but the lower TTL, the higher load on server (`man sssd.conf` search for cache).<br /><br /> Martin</div>
</blockquote>
<p><br /></p>
</body></html>