SSSD / sssd

#3321 userCertificate is not removed from entry in cache
Closed: cloned-to-github by pbrezina. Opened by dkupka.

Closed: cloned-to-github
Reopen Issue

When certificate is added to user cache gets populated almost instantly but when the certificate is removed from the entry it is not removed from entry in the cache even when the cache is manually expired.
I've hit this issue with Sumit's builds [1] but I believe that this is an issue with caching and not with certificate mapping feature.

[1] https://copr.fedorainfracloud.org/coprs/sbose/pkinit_and_certificate_mapping/

Steps to reproduce:

# ipa user-add tuser --first Test --last User
# ipa user-add-cert tuser --certificate $(cat ~/tuser.pem | head -n -1 | tail -n +2 | tr -d '\r\n')
# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat ~/tuser.pem)" uint32:100
# ipa user-add ouser --first Other --last User
# ipa user-add-cert ouser --certificate $(cat ~/tuser.pem | head -n -1 | tail -n +2 | tr -d '\r\n')
# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat ~/tuser.pem)" uint32:100
# ipa user-remove-cert tuser --certificate $(cat ~/tuser.pem | head -n -1 | tail -n +2 | tr -d '\r\n')
# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat ~/tuser.pem)" uint32:100
# sudo sss_cache -E
# dbus-send --system --print-reply --dest=org.freedesktop.sssd.infopipe /org/freedesktop/sssd/infopipe/Users org.freedesktop.sssd.infopipe.Users.ListByCertificate string:"$(cat ~/tuser.pem)" uint32:100

Actual result (ipa outputs omitted):

method return time=1488893851.804254 sender=:1.254 -> destination=:1.257 serial=11 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]
method return time=1488893892.719728 sender=:1.254 -> destination=:1.258 serial=13 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]                                                                                                                                                                                                                                         
method return time=1488893911.276792 sender=:1.254 -> destination=:1.259 serial=15 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]
method return time=1488893934.423090 sender=:1.254 -> destination=:1.261 serial=17 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]

Expected output (ipa outputs omitted): 

method return time=1488893851.804254 sender=:1.254 -> destination=:1.257 serial=11 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]
method return time=1488893892.719728 sender=:1.254 -> destination=:1.258 serial=13 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400005"
]                                                                                                                                                                                                                                         
method return time=1488893911.276792 sender=:1.254 -> destination=:1.259 serial=15 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
]
method return time=1488893934.423090 sender=:1.254 -> destination=:1.261 serial=17 reply_serial=2
array [
object path "/org/freedesktop/sssd/infopipe/Users/dom_2d058_2d055_2eabc_2eidm_2elab_2eeng_2ebrq_2eredhat_2ecom/14400006"
]

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.15.3

Metadata Update from @jhrozek:
- Issue priority set to: major

Since upstream would like to release a next tarball quite soon, but at the same time this issue is not a blocker, I'm moving it to the next milestone.

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.15.4 (was: SSSD 1.15.3)

Metadata Update from @jhrozek:
- Issue tagged with: cleanup-one-sixteen

Metadata Update from @jhrozek:
- Issue untagged with: cleanup-one-sixteen
- Issue priority set to: minor (was: major)

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.0 (was: SSSD 1.15.4)

Since we are required to release a new upstream tarball no later than Friday Oct-20, I'm moving tickets that will not be closed by that date to the next milestone, 1.16.1

Since we are required to release a new upstream tarball no later than Friday Oct-20, I'm moving tickets that will not be closed by that date to the next milestone, 1.16.1

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 1.16.1 (was: SSSD 1.16.0)

Metadata Update from @jhrozek:
- Issue tagged with: bug, postpone-to-2-0

Metadata Update from @jhrozek:
- Issue untagged with: postpone-to-2-0
- Issue set to the milestone: SSSD 2.0 (was: SSSD 1.16.1)

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.1 (was: SSSD 2.0)

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.2 (was: SSSD 2.1)

Metadata Update from @jhrozek:
- Issue set to the milestone: SSSD 2.3 (was: SSSD 2.2)

Metadata Update from @thalman:
- Issue tagged with: Next milestone

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4353

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.

Metadata Update from @pbrezina:
- Issue close_status updated to: cloned-to-github
- Issue status updated to: Closed (was: Open)
Metadata
None

Next milestone bug

None
None
High
None
None
None
None
None
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.