Description of problem: In an IPA environment with trust to AD a deleted user from a trusted domain is not properly removed from the cache on IPA clients. Version-Release number of selected component (if applicable): sssd-1.16.0-19.el7.x86_64
Since this bug report was entered in Red Hat Bugzilla, the release flag has been set to ? to ensure that it is properly evaluated for this release.
Upstream ticket: https://pagure.io/SSSD/sssd/issue/3984
* master: 50641d4 5d50621 89d8962 e8b2f0d b1d288b * sssd-1-16 3bed774 b424c8a c382167 19fbcd1 cca3394
Verifying based on following output IPA master: ============ (1) Creating AD user and requesting it [root@master ~]# adcli create-user --domain=ipaad2k16cin.test testaduser1 Password for Administrator: [root@master ~]# getent passwd 'IPAAD2K16CIN\testaduser1' testaduser1:*:879005770:879005770:testaduser1:/home/ipaad2k16cin.test/testaduser1: (2) Deleting AD user, clearing the sssd cache and requesting user again which fails now on master [root@master ~]# adcli delete-user --domain=ipaad2k16cin.test testaduser1 Password for Administrator: [root@master ~]# sss_cache -E [root@master ~]# getent passwd 'IPAAD2K16CIN\testaduser1';echo $? 2 [root@master ~]# rpm -q sssd sssd-1.16.4-21.el7.x86_64 [root@master ~]# IPA client: ============ (1) Requesting AD user created on Master in step(1) [root@replica1 ~]# getent passwd 'IPAAD2K16CIN\testaduser1' testaduser1:*:879005770:879005770:testaduser1:/home/ipaad2k16cin.test/testaduser1: [root@replica1 ~]# (2) Clearing the sssd cache and requesting user again which fails now on client [root@replica1 ~]# sss_cache -E [root@replica1 ~]# getent passwd 'IPAAD2K16CIN\testaduser1';echo $? 2 [root@replica1 ~]# rpm -q sssd sssd-1.16.4-21.el7.x86_64 [root@replica1 ~]#
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2019:2177
BZ not letting me link solution, so doing as a comment https://access.redhat.com/solutions/4341951