<html><head></head><body><div>On Fri, 2016-06-10 at 11:08 +0200, Sumit Bose wrote:</div><blockquote type="cite"><pre>On Fri, Jun 10, 2016 at 09:54:19AM +0100, lejeczek wrote:
<blockquote type="cite">
hi everyone
there is a master IPA which in some weird way puts AD users into its ldap
catalog. I say weird cause there is no trust nor other sync established,
there was a trust agreement, one way type, but now 'trust-find' shows
nothing, that trust was removed.
but still when I create a user @AD DS a second later I see it in IPA's ldap,
eg.
dn: <a href="mailto:uid=ccnrtest@ccnr.aaa.private.dom">uid=ccnrtest@ccnr.aaa.private.dom</a>,cn=users,cn=compat,dc=private,dc=c
cnr,dc=aaa,dc=private,dc=dom
how to trace the culprit config responsible for this?
and funny(?) thing is that these users do not get replicated to IPA
replicas.
</blockquote>
Did you remove the trust on the AD side as well. If not SSSD running on
the IPA server might still have valid credentials in a keytab in
/var/lib/sss/db and is able to read the user data from AD.
</pre></blockquote><div>nope, not agreements left @AD,</div><div>I tried: $ sss_cache -E -d ad.domain</div><div>but it segfaulted:</div><div>[1316003.857780] sss_cache[31028]: segfault at 0 ip 00007fab730f434c sp 00007fffbf576c10 error 4 in libsss_util.so[7fab730c8000+68000]</div><div><br></div><div>so that would be sssd actually pulling and inserting these entries in IPA's ldap?</div><div>many thanks,</div><div>L</div><div><br></div><blockquote type="cite"><pre>
HTH
bye,
Sumit
<blockquote type="cite">
many thanks,
L
--
Manage your subscription for the Freeipa-users mailing list:
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a>
Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project
</blockquote></pre></blockquote></body></html>