Linux users still able to authenticate after AD group mebership removed

This document (7022291) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Linux Enterprise Server 11 Service Pack 4 (SLES 11 SP4)
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server 12 Service Pack 1 (SLES 12 SP1)
SUSE Linux Enterprise Server 12 Service Pack 2 (SLES 12 SP2)
SUSE Linux Enterprise Server 12 Service Pack 3 (SLES 12 SP3)

Situation

Users are allowed to authenticate depending on membership of certain Active Directory security groups. When a user is removed from these groups, users are still able to authenticate to the Linux server.

Resolution

This requires tuning to reduce the time-lag between AD group membership removal and login being denied.

Alternatively, disabling nscd group caching will make the change appear instant, depending on the Active Directory change-replication process and which DC is contacted to provide the group membership details.

If there is still an unacceptable delay in users being denied login access after disabling nscd group caching, then making sure the 'Password Server' option is configured to point to the DC where the group membership changes are made first, should eliminate any delay caused by the AD change-replication schedule.

Cause

Customer understanding of how the nscd mechanism works may be inaccurate.

Active Directory change-replication cycle may be too slow to propagate changes depending on how many DC's there are and their geographical spread.

Configuration may need 'tuning'.

Additional Information

Link to nscd documentation

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.