Hi,
any recommendations how to best update the compat tree after changes of AD user attributes?
We use IPA 4.5 with AD trust. After modification of a AD user attribute, e.g. loginShell, the compat tree doesn't get updated automatically and so the unix/linux can't enjoy his new shell.
Accourding to Red Hat's knowledge base article https://access.redhat.com/solutions/1503713 the only way is to restart dirsrv ...
Maybe there's a better way to achieve this.
Thanks in advance!
Mit freundlichen Grüßen
Matthias Lenhardt System Administrator
BITMARCK Beratung GmbH Firmensitz: Putzbrunner Straße 93, 81739 München Geschäftsführer: Christian Niklaus Registergericht: Amtsgericht München HRB 130163
*****************************************************************
Die Information in dieser E-Mail ist vertraulich und ausschließlich für den/die benannten Adressaten bestimmt. Ein Zugriff auf diese E-Mail durch andere Personen als den/die benannten Adressaten ist nicht gestattet. Sollten Sie nicht der benannte Adressat sein, löschen Sie bitte diese E-Mail.
[http://postmaster.bitmarck.de/images/signatur_neuer_standort_essen.png]
On to, 30 marras 2017, Lenhardt, Matthias via FreeIPA-users wrote:
Hi,
any recommendations how to best update the compat tree after changes of AD user attributes?
We use IPA 4.5 with AD trust. After modification of a AD user attribute, e.g. loginShell, the compat tree doesn't get updated automatically and so the unix/linux can't enjoy his new shell.
Accourding to Red Hat's knowledge base article https://access.redhat.com/solutions/1503713 the only way is to restart dirsrv ...
Maybe there's a better way to achieve this.
Not right now. We are working on improvements, though. Hopefully, they'll be in next RHEL update. I need to update Fedora packages too but as we depend on somewhat newer SSSD functionality which is not released yet (backports from git master are in Fedora as of last week), it was delayed.
Do you run RHEL or CentOS?
-----Ursprüngliche Nachricht----- Von: Alexander Bokovoy [mailto:abokovoy@redhat.com] Gesendet: Donnerstag, 30. November 2017 17:40 An: FreeIPA users list freeipa-users@lists.fedorahosted.org Cc: Lenhardt, Matthias Matthias.Lenhardt@bitmarck.de Betreff: Re: [Freeipa-users] Update of compat tree after change of AD user attributes
On to, 30 marras 2017, Lenhardt, Matthias via FreeIPA-users wrote:
Hi,
any recommendations how to best update the compat tree after changes
of
AD user attributes?
We use IPA 4.5 with AD trust. After modification of a AD user attribute, e.g. loginShell, the compat tree doesn't get updated automatically and so the unix/linux can't enjoy his new shell.
Accourding to Red Hat's knowledge base article https://access.redhat.com/solutions/1503713 the only way is to restart dirsrv ...
Maybe there's a better way to achieve this.
Not right now. We are working on improvements, though. Hopefully, they'll be in next RHEL update. I need to update Fedora packages too but as we depend on somewhat newer SSSD functionality which is not released yet (backports from git master are in Fedora as of last week), it was delayed.
Do you run RHEL or CentOS?
We are running RHEL 7.4 on IPA server. Clients are a mix of RHEL 7, CentOS 7 and Solaris systems.
In principle I have no problem in refreshing dirsrv, if you say, this is right at the moment the way to do this. Would it be enough to restart only one of my two dirsrv services and the other one will be refreshed through replication?
-- / Alexander Bokovoy
Best Regards/Mit freundlichen Grüßen
Matthias Lenhardt System Administrator
BITMARCK Beratung GmbH Firmensitz: Putzbrunner Straße 93, 81739 München Geschäftsführer: Christian Niklaus Registergericht: Amtsgericht München HRB 130163
****************************************************************
Die Information in dieser E-Mail ist vertraulich und ausschließlich für den/die benannten Adressaten bestimmt. Ein Zugriff auf diese E-Mail durch andere Personen als den/die benannten Adressaten ist nicht gestattet. Sollten Sie nicht der benannte Adressat sein, löschen Sie bitte diese E-Mail. [http://postmaster.bitmarck.de/images/signatur_neuer_standort_essen.png]
On pe, 01 joulu 2017, Lenhardt, Matthias wrote:
-----Ursprüngliche Nachricht----- Von: Alexander Bokovoy [mailto:abokovoy@redhat.com] Gesendet: Donnerstag, 30. November 2017 17:40 An: FreeIPA users list freeipa-users@lists.fedorahosted.org Cc: Lenhardt, Matthias Matthias.Lenhardt@bitmarck.de Betreff: Re: [Freeipa-users] Update of compat tree after change of AD user attributes
On to, 30 marras 2017, Lenhardt, Matthias via FreeIPA-users wrote:
Hi,
any recommendations how to best update the compat tree after changes
of
AD user attributes?
We use IPA 4.5 with AD trust. After modification of a AD user attribute, e.g. loginShell, the compat tree doesn't get updated automatically and so the unix/linux can't enjoy his new shell.
Accourding to Red Hat's knowledge base article https://access.redhat.com/solutions/1503713 the only way is to restart dirsrv ...
Maybe there's a better way to achieve this.
Not right now. We are working on improvements, though. Hopefully, they'll be in next RHEL update. I need to update Fedora packages too but as we depend on somewhat newer SSSD functionality which is not released yet (backports from git master are in Fedora as of last week), it was delayed.
Do you run RHEL or CentOS?
We are running RHEL 7.4 on IPA server. Clients are a mix of RHEL 7, CentOS 7 and Solaris systems.
In principle I have no problem in refreshing dirsrv, if you say, this is right at the moment the way to do this. Would it be enough to restart only one of my two dirsrv services and the other one will be refreshed through replication?
slapi-nis produces virtual entries on request so it is not really related to replication. Sure, ID overrides get replicated but anything under cn=compat,$SUFFIX is not.
You need to consider cn=compat,$SUFFIX on each server separately.
freeipa-users@lists.fedorahosted.org
-
Alexander Bokovoy -
Lenhardt, Matthias