LDAP won't update if cached data exists

active-directory ldap nss selinux
john146 picture john146 · Jan 12, 2009 · Viewed 11.5k times · Source

We have an SELinux client that authenticates network users using LDAP connecting to an Active Directory server. Since our machines have to operate "untethered," we have to use nscd to cache group and passwd info.

Here's the issue. If we change group information on the Active Directory server, then log in on the client, if a cache exists for that user, LDAP seems to ignore the server and only use the cached data. The only way we've been able to get an update is to invalidate the passwd cache.

Significant portion of /etc/nsswitch.conf:

    passwd: file ldap cache
    group:  file ldap cache
    shadow: file ldap cache

Thanks.

Update: Figured out running strace getent passwd that nscd cache gets checked before /etc/nsswitch.conf gets read, so the configuration of nss doesn't matter.

Update 2: Playing with nss_updatedb today to see if it will work. So far no joy, although this howto looks like exactly what we need to do.

Answer

Patrick picture Patrick · Jan 13, 2009

If you don't want to cache results from active directory then you need to either turn off nscd or set its cache life time to a few minutes (edit /etc/nscd.conf). I believe the default time to live is 10 minutes for passwd and and hour for group.

Related questions

What are the differences between LDAP and Active Directory?

What are the differences between LDAP and Active Directory?

Read More
What are CN, OU, DC in an LDAP search?

I have a search query in LDAP like this. What exactly does this query mean? ("CN=Dev-India,OU=Distribution Groups,DC=gp,DC=gl,DC=google,DC=com");

Read More
Query to list all users of a certain group

How can I use a a search filter to display users of a specific group? I've tried the following: (& (objectCategory=user) (memberOf=MyCustomGroup) ) and this: (& (objectCategory=user) (memberOf=cn=SingleSignOn,ou=Groups,dc=tis,dc=eg,dc=ddd,…

Read More