Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Recently we change the ip address (and add some groups) of our LDAP server (running in Suse Enterprise) so should change also the ldap authenthication configurations for all the servers that we have.

Most of the servers are on Centos. We modified the ldap_uri parameter in /etc/sssd/sssd.conf to the new server but when we login to the server and make a:

id user

we obtain the user information for the old server and not the new one. In fact if we change the sssd.conf to use an ldap_uri that doesn't exist we still obtain from the command id user the same response.

The authldapconfig --test say that caching is disabled, we tried also to reboot the server and the clients and nothing work. Is there some cache for the ldap clients that have to be refresh?

NOTE: in /etc/openldap/ldap.conf the uri is commented.

The sssd.conf file is:

[domain/default]

ldap_id_use_start_tls = False
cache_credentials = True
ldap_search_base = dc=maxcrc,dc=com
krb5_realm = EXAMPLE.COM
krb5_server = kerberos.example.com
id_provider = ldap
auth_provider = ldap
chpass_provider = ldap
#ldap_uri = ldap://172.31.7.17/
ldap_uri = ldap://172.31.7.206/
ldap_tls_cacertdir = /etc/openldap/cacerts
ldap_tls_reqcert = never
ldap_schema = rfc2307bis
entry_cache_timeout = 600
ldap_network_timeout = 3
ldap_access_filter = (&(objectclass=shadowaccount)(objectclass=posixaccount))

Thanks for your help

share|improve this question
    
are you using nscd? –  ALex_hha Aug 2 '13 at 10:11
    
No, we are not using nscd –  Paco Trujillo Aug 2 '13 at 10:24
    
How do you know you're obtaining information from the older server? If you explicitly query the new server using ldapsearch, do you get back the information you expect? Are your LDAP clients actually making connections to the old server (verified with, e.g., netstat or tcpdump)? –  larsks Aug 2 '13 at 11:39
    
I know that the information if the information that it is located in the old server because I introduced intentionally a user that is different. The information can not provide from the old server because the uri doesnt correspond to any existing LDAP server. Querying with ldapsearch using an LDAP browser works but not for authenthication when I tried to access the servers using ssh –  Paco Trujillo Aug 2 '13 at 13:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.