Bug 1475985

Description of problem:

sssd cache have invalid group, which already been deleted long time, but still in the cache, have the gid number: 1404.

and there is new group are using the gid again 1404. on the ldap side the gid number is uniqe, but in the sssd cache there are two entry with same gid, that cause id command can not get the group name.


id: cannot find name for group ID 1404

dump the cache:
# record 571
dn: name=xxxx1
createTimestamp: 1500531223
gidNumber: 1404
objectClass: group
isPosix: TRUE
...

# record 7521
dn: name=xxxx2
createTimestamp: 1495122412
gidNumber: 1404
objectClass: group
isPosix: TRUE

group name is different.xxxx2 is the old group, and after i try getent group xxxx2, then the old group is gone, i think the sssd found it's not exist in ldap, so remove it.

my quesiton, why this remove dose not happen when the ldap group remove in ldap server side.

sssd.conf:

[sssd]
config_file_version = 2
reconnection_retries = 3

# If a back end is particularly slow you can raise this timeout here
sbus_timeout = 30
services = nss, pam
domains = AD

[nss]
filter_groups = root
filter_users = root
reconnection_retries = 3

[pam]
reconnection_retries = 3

# Example LDAP domain where the LDAP server is an Active Directory server.

[domain/AD]
description = LDAP domain with AD server
enumerate = false

debug_level = 7

ldap_id_use_start_tls = False
cache_credentials = True
id_provider = ldap
auth_provider = krb5
chpass_provider = krb5
ldap_schema = rfc2307bis
ldap_force_upper_case_realm = True
ldap_user_object_class = person
ldap_group_object_class = group
ldap_user_gecos = gecos
ldap_user_home_directory = unixHomeDirectory
ldap_uri =  ldap://xxxxx
ldap_search_base = dc=apd,dc=ebay,dc=com
ldap_default_bind_dn = xxxxx
#ldap_group_search_base = ou=Group,dc=ebay,dc=com
ldap_group_search_base = OU=Groups,OU=Data,xxxx
ldap_default_authtok_type = password
ldap_default_authtok = xxxx
ldap_referrals = false
krb5_realm = xxx
krb5_kpasswd = xxxxx
krb5_kdcip = xxxx
ldap_user_name = sAMAccountName
ldap_user_uid_number = uidNumber
ldap_user_gid_number = gidNumber
ldap_user_search_filter = (&(uidNumber=*)(gidNumber=*))
ldap_group_search_filter = (objectClass=group)
#ldap_group_name = name
#ldap_group_member = member



Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: