I have configured my linux machines (running CentOS 5.2) to authenticate against a Windows server running Active Directory. I have even enabled winbind offline logon. Everything works as expected, however I'm also looking to impose a TTL for the winbind authentication cache. So far all I found was the below snippet from the samba documentation

winbind cache time (G)

This parameter specifies the number of seconds the winbindd(8) daemon will cache user and group information before querying a Windows NT server again.

*This does not apply to authentication requests*, these are always evaluated in real time unless the winbind offline logon option has been enabled.

Default: winbind cache time = 300

Clearly the winbind cache time parameter does not control the cache TTL for authentication requests. Is there any other way I can implement a cache timeout for winbind authentication requests?

Thank you


I was initially using the default idmap backend. However, when i switched the idmap backend to AD, the problem was fixed. Below are the config options i used in smb.conf.

idmap config MYDOMAIN:backend = ad
idmap config MYDOMAIN:default = yes
idmap config MYDOMAIN:schema mode = rfc2307
idmap config MYDOMAIN:range = 1000-60000

idmap cache time = 1
idmap negative cache time = 1
winbind cache time = 1

Note however that i still have to logout and log back in to see any changes that were made on the AD side to group memberships.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.