Linux users still able to authenticate after AD group mebership removed
This document (7022291) is provided subject to the disclaimer at the end of this document.
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)
SUSE Linux Enterprise Server 12 Service Pack 3 (SLES 12 SP3)
Alternatively, disabling nscd group caching will make the change appear instant, depending on the Active Directory change-replication process and which DC is contacted to provide the group membership details.
If there is still an unacceptable delay in users being denied login access after disabling nscd group caching, then making sure the 'Password Server' option is configured to point to the DC where the group membership changes are made first, should eliminate any delay caused by the AD change-replication schedule.
Active Directory change-replication cycle may be too slow to propagate changes depending on how many DC's there are and their geographical spread.
Configuration may need 'tuning'.
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:7022291
- Creation Date: 08-Nov-2017
- Modified Date:03-Mar-2020
- SUSE Linux Enterprise Server
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com