Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

On our box running OpenSUSE 12.2 we have installed OpenLDAP and sssd daemon. We are using these two services for user authentication. Recently we created a script which creates new web-users for our vhosts dynamically, but now we are dealing with a problem.

It seems that sssd uses some kind of cache and during getent passwd it returns users that have been deleted from LDAP. Sometimes it doesn't return recently created user immediately as it is necessary further in the script (for setting permissions with setfacl and chown).

Restarting LDAP, sssd or nscd doesn’t help, neither flushing cache with sss_cache -U. We tried lowering cache in config of sssd but it seems that it doesn’t affect anything.

We need to somehow explicitly refresh the cache after adding new user to LDAP or disable the cache at all.

Has anyone experienced similar issue?

share|improve this question

2 Answers 2

  • You can't disable caching completely with sssd.

  • You can disable sss as an authentication provider completely and just query LDAP directly if that's what you want.

For example, in /etc/nsswitch.conf, change lines like:

passwd:     files sss


passwd:     files ldap
  • You can force cleaning of the cache by removing /var/lib/sss/db/*
share|improve this answer
This is wrong. There's a configuration directive that controls caching. –  ewwhite May 14 '13 at 7:14
Are you referring to cache_credentials? Does that disable all caching or just credentials, as the name would imply? –  Grisha Levit May 20 '13 at 17:20

You could try to disable caching credentials by adding directive to /etc/sssd/sssd.conf:

cache_credentials = False

You may then verify that sssd uses cache on credentials with console command:

# authconfig --test|grep credential
credential caching in SSSD is disabled
share|improve this answer
authconfig is redhat command, the problem is about OpenSUSE 12.2 –  c4f4t0r Nov 29 '13 at 15:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.