changes to domain group membership not showing for user in SLES 11 SP3

Question

Joined server linux02 runing SUSE enterprise linux server service pack 3 to a Windows active directory domain example.com no problem.

Users, like fred from the domain can login no problem via ssh EXAMPLE\\[email protected]

When logged in as domain user, running groups command shows all domain groups no problem.

Logout fred and reboot linux02

On Windows domain controller, make fred a member of group linux_sudoers

fred logs into linux02 and runs groups command, but only all the old groups are displayed. Problem: fred doesn't appear to be a member of linux_sudoers

Now when running wbinfo --group-info=EXAMPLE\\linux_sudoers, low and behold he appears to be a member:
EXAMPLE\linux_sudoers:x:10073:EXAMPLE\fred
But when running groups again, the new group still isn't in the list.

Now back on the Windows domain controller, I create a new user john and make him a member of linux_sudoers

john is now able to login to linux02 no problem, and when running the groups command shows he is a member of linux_sudoers

Subsequent tests show that a user is essentially locked into the domain group memberships that existed at the time of first login to linux02 and no changes from the domain will ever reflect regardless of logging out or even rebooting the server. I'm out of ideas. Any hints out there?

Answer:

@David King was right! Specifically, I needed to run these commands:

service smbfs stop
service winbind stop
rm -rf /var/lib/samba/*tdb

I didn't have any files in /var/cache/samba/

service smbfs start
service winbind start

Logged in with fred and ran groups and sure enough he shows as a member of linux_sudoers

Thanks @David King!

Answer 1

The issue is a timeout. Linux is caching the group memberships and not renewing them until the timeout expires. It's super annoying. The even more annoying part is that the only way I've found to force it to update is to delete the caches

/etc/init.d/samba stop
rm -rf /var/cache/samba/* /var/lib/samba/*tdb
/etc/init.d samba start

I don't use SLES so you might need to do adjust this to fit how SLES starts/stops services but the important thing to note is that samba and winbind must be stopped when you delete the caches.