shardpostctl-auth(1)

NAME

shardpostctl-auth - flush the auth cache of every server

SYNOPSIS

shardpostctl auth flush [--json] [account]

DESCRIPTION

Every server keeps the logins and lookups Nauthilus answered for a short time (the auth cache, auth.cache.ttl, 30 seconds by default, and auth.cache.lookup_ttl for lookups). A change in LDAP — a locked account, a removed alias, a new quota, a changed display name — reaches ShardPost only when the entry ends. auth flush drops the entries at once.

With an account it drops every entry whose login name, lookup name or canonical account is that name, compared without regard to case: the account itself, an alias or an address all work. Without one it drops every entry.

The server that answers flushes its own cache before it answers and records the flush in the cluster's flush log. The other servers apply it when they are notified and at the latest on their next poll, 60 seconds later; the command does not wait for them. The flush reaches neither the Director's routing cache (up to 30 seconds) nor the cache of Nauthilus itself, which needs its own flush for a change that has to take effect at once.

A server without an auth cache (the static backend, or auth.cache.ttl 0) answers that nothing was cached.

Role: repair. The flush is written to the audit log.

OPTIONS

--json

Print the answer as JSON: account (the name in lower case, or * for every entry) and cached (whether the server has an auth cache).

EXAMPLES

An account was locked in LDAP and has to be locked out now (flush Nauthilus' cache as well):

shardpostctl auth flush user@example.org

An alias was removed; LMTP should stop accepting it:

shardpostctl auth flush alias@example.org

An account moves to another shard: flush it on the source and on the target shard, then hold the account for at least lookup_ttl plus the Director's 30 seconds before pinning it:

kubectl -n shardpost exec deploy/shardpost-server -c server -- \


    shardpostctl auth flush user@example.org

Something looks stale and nobody knows what: flush everything.

shardpostctl auth flush

EXIT STATUS

0

Flushed on this server and recorded for the others (or nothing to flush on a server without an auth cache).

64

Wrong usage.

75

This server was flushed, but the flush could not be recorded for the other servers, or the server could not be reached. Try again.

77

The caller lacks the role repair.

SEE ALSO

shardpostctl(1), shardpostctl-account(1)

The auth cache is described in docs/configuration.md (section auth), what each change costs until it takes effect in docs/operations/README.md.