Bug 1373293 - sss_cache doesn't invalidate group entry in main sysdb cache
Summary: sss_cache doesn't invalidate group entry in main sysdb cache
Keywords:
Status: CLOSED DUPLICATE of bug 1371538
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: SSSD Maintainers
QA Contact: Steeve Goveas
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-05 19:56 UTC by Amith
Modified: 2016-09-06 07:04 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-06 07:04:32 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Amith 2016-09-05 19:56:00 UTC
Description of problem:
sss_cache -E command invalidates all the user entries in main sysdb cache and timestamp cache, however the group entry in sysdb main cache is unaffected. sss_cache invalidates only the timestamp cache group entries.

Version-Release number of selected component (if applicable):
sssd-1.14.0-34.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Setup 389-ds ldap server and add a test group to it.

2. Setup Rhel-7.3 with SSSD client against LDAP provider.
Sample sssd.conf :
---------------------------------------------
[sssd]
config_file_version = 2
domains = LDAP
services = nss, pam

[domain/LDAP]
id_provider = ldap
auth_provider = ldap
debug_level = 0xFFF0
cache_credentials = FALSE
ldap_uri = ldaps://<LDAP_SERVER>
ldap_tls_cacert = /etc/openldap/certs/cacert.asc
ldap_search_base = dc=example,dc=com

3. Run a group lookup.
# getent group "Group R A"
Group R A:*:111000:
 
4. Try to expire the group record.
# sss_cache -E

5. Run ldbsearch and verify the dataExpireTimestamp in main sysdb (cache_LDAP.ldb).

# ldbsearch -H cache_LDAP.ldb -b "name=Group R A@ldap,cn=groups,cn=LDAP,cn=sysdb" | grep dataExpireTimestamp
asq: Unable to register control with rootdse!
dataExpireTimestamp: 1473107970

6. Run ldbsearch and verify the dataExpireTimestamp in time stamp cache.

# ldbsearch -H timestamps_LDAP.ldb -b "name=Group R A@ldap,cn=groups,cn=LDAP,cn=sysdb" | grep dataExpireTimestamp
dataExpireTimestamp: 1
 
Actual results:
dataExpireTimestamp in sysdb main cache is not set to 1 (or its not invalidated).

Expected results:
dataExpireTimestamp in sysdb main cache should be set to 1 for the group entries like other user entries in the cache.

Additional info:

Comment 2 Jakub Hrozek 2016-09-06 07:04:32 UTC
This is already known as https://bugzilla.redhat.com/show_bug.cgi?id=1371538

*** This bug has been marked as a duplicate of bug 1371538 ***


Note You need to log in before you can comment on or make changes to this bug.