ssoosshd ldap sync
Runs, in this process, the pass POST /api/admin/ldap/sync runs: the LDAP enrichment sync over every user who has logged in with the directory on, which refreshes their directory data and applies ldap.sync.disable_after and ldap.sync.reenable; then, with nss.enabled on, the NSS directory’s full sync. It reports what the pass concluded and records an ldap.sync_triggered audit event whose actor is local-cli.
With –dry-run the LDAP pass reads the directory and changes nothing, reporting the disables and re-enables it would have performed, and the NSS sync is skipped: it has no dry run.
Safe beside a running server: the scheduled syncs are not leader-elected, so every instance already runs its own, and this is one more. A restart does not run a sync; the scheduled ones first run one interval after start.
The database is the server’s, opened from the same config file, and is never migrated: its schema must match this ssoosshd. Exits non-zero when either pass fails, with the reason on stderr; the process log goes to stderr too.
Synopsis
Section titled “Synopsis”ssoosshd ldap sync [flags] [args]Options
Section titled “Options”| Flag | Type | Default | Description |
|---|---|---|---|
--dry-run |
bool | false |
read the directory and change nothing; skips the NSS sync |
--json |
bool | false |
print the result as JSON, in the sync endpoint’s response shape |
Global options
Section titled “Global options”Inherited from ssoosshd and its parents.
| Flag | Type | Default | Description |
|---|---|---|---|
-c, --config |
string | path to the ssoosshd config file |