We have a small network using 389 Directory Server for LDAP. We make LDAP users, those users log on to various machines in the network, and then sometimes we delete those users. However, after deleting an LDAP user, artifacts remain on each system that user accessed. I don't even know everything that's left behind, but I've identified the following: home directory, sssd cache entries, and AccountsService cache entries. Besides leftovers on the file system, this results in deleted users showing up on the gdm login screen, and if a new LDAP user is created with the same uid or username as a deleted user it causes problems (wrong name displayed or can't create home directory and gdm goes back to the login screen). How do you cleanup each local system after deleting an LDAP user?
This is what I have so far: kill all of their processes, delete their home directory,
systemctl restart sssd,
systemctl restart accounts-daemon. What else am I missing or is there a better way?
Even if you have a full cleanup procedure or script, do you manually run it on every system? Is there a good way to automate cleanup on LDAP deletion? I tried making a 389 Directory Server Post-Operation plug-in with a post-delete callback, but I couldn't get 389 Directory Server to load the plug-in. When I try to use ldapmodify to add the plug-in, it fails:
ldap_add: Server is unwilling to perform (53) additional info: Invalid plugin path myplugin.so - failed to open library. The first time I saw this error, I found systemd log entries showing SELinux was blocking execution, but after taking the recommended actions, I now see nothing useful in systemd nor dirsrv logs, so I have no idea why it's failing.