Issue

• sss_cache somehow fails to invalidate netgroup entries from LDAP when entry is changed. We use netgroups to control login to hosts via access.conf.
• When adding(or removing) an entry in the LDAP netgroup, sssd does not update its cache until either a restart, reboot or deleting of the cache db. sss_cache does not help.

For example:

# getent netgroup netgr
// shows netgroup, expected

(remove netgroup from LDAP) 
# sss_cache -N 

# getent netgroup netgr
// still shows the netgroup, should not