Update ldap user information and it can't be identified by keystone

[jun923.gu]

I encounter a situation that keystone can't identify the updated user information after updating ldap user. Because keystone use memcached server as a cached backend, the get_user api get user information from memcached server if the cached user information is not expired. The updated ldap user can't be updated into memcached server, so the get_user api get the origin user information, not updated user information.I am curious whether there are some solutions to solve the problem.

[Vishakha Agarwal (vishakha.agarwal)]

Could you also share some details to reproduce this like OpenStack release you are using? Is it over the master? Have you seen updated information reflected on LDAP in previous releases? Also I have a few more questions in my mind whether the user information was successfully updated in the LDAP.

[Colleen Murphy (krinkle)]

There's no way for the LDAP backend to notify the keystone cache that it is out of date. The same problem would happen if you edited the SQL database directly. The only suggestion I can offer is to reduce the cache expiration time in the [cache]/expiration_time setting in keystone.conf.

[jun923.gu (gujun1989)]

@krinkle,thank you for your reply. I agree with you. @vishakha.agarwal, currently, I think there's no effect method to solve this problem except avoiding it, such as reduce the cache expiration as krinkle had talked.

[Colleen Murphy (krinkle)]

Glad I could help, I will mark this bug as "invalid" since the question has been answered.