[Samba] winbind samlogon issue

[Jason Keltz]

On 2/17/2021 7:50 PM, Andrew Bartlett via samba wrote:
> On Wed, 2021-02-17 at 19:37 -0500, Jason Keltz wrote:
>> On 2/17/2021 7:32 PM, Andrew Bartlett via samba wrote:
>>> On Wed, 2021-02-17 at 19:19 -0500, Jason Keltz via samba wrote:
>>>> I wanted to ask for more information on "net cache samlogon" and
>>>> its
>>>>
>>>> relation to "winbind cache time".
>>> None.  This information is sticky until the next login, forever.
>>>
>>> We would like to eventually refresh this information via a ticket
>>> obtained with S4U2Self, but we can't right now.
>>>
>>> At one point we were thinking to totally remove the ability to find
>>> out
>>> much about users who hadn't ever logged in, because the
>>> alternatives
>>> are unreliable, but this never proceeded.
>>>
>>> I hope this helps,
>>>
>> Hi Andrew,
>>
>> So if I need to refresh the users groups on each login, would I then
>> need to clear these samlogon entries on my own?   Can I tell winbind
>> not
>> to store them in the first place?
> Not currently.
>
>> Why does it appear that without doing this, the users groups get
>> updated
>> sometimes and not other times?
> This is the argument for removing the other ways of obtaining group
> info.  If there isn't a samlogon cache, then we make as best as we can,
> subject to the cache time.  But it isn't as reliable (mostly in cross-
> realm interdomain trust situations) and as you found it means it isn't
> consistent.
>
>> And then what is the "winbind cache time" ?
> For other things that we were not able to work out from the samlogon
> cache.
>
> I know this sucks,
>
If I regularly clear the samlogon cache, I believe I get the updated 
groups, so it's like the equivalent of expiring it.  I'd rather if I 
didn't have to do it, but at least there is a way.  It would be 
preferable, of course, if the samlogon cache expired on its own using 
the winbind cache time.   With SSSD, I think setting 
"entry_cache_timeout" would do the same thing as me manually clearing 
the samlogon cache in winbind.  Lots of fun.

Jason.