How to organize the update of LDAP users on the fly in squid?

Question

LDAP

Good day everyone.
I have such config squids on Centos 7

# Only NTLM authentication
auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=EXAMPLE
auth_param ntlm children 100 startup=20 idle=5
auth_param ntlm keep_alive off
# Basic authentication via ldap for clients not authenticated via kerberos/ntlm
auth_param basic program /usr/lib64/squid/basic_ldap_auth -v 3 -P -R -b "ou=Department,dc=example,dc=com" -D [email protected] - W /etc/squid/password.conf -f sAMAccountName=%s -h dns.example.com
auth_param basic children 20
auth_param basic realm "SQUID Proxy Server Basic authentication!"
auth_param basic credentialsttl 2 hours
external_acl_type memberof ttl=3600 ipv4 %LOGIN /usr/lib64/squid/ext_ldap_group_acl -v 3 -P -R -K -b "dc=example,dc=com" -D [email protected] -W /etc/squid/ password.conf -f "(&(objectclass=person) (memberOf:1.2.840.113556.1.4.1941:=cn=%g,ou=ServiceUsers,ou=Department,DC=example,DC=com))" -h dns.example.com

Everything reads from the domain perfectly and works great.
But there is a point that I can not make out in any way. If I change membership in the corresponding (with which squid works) group for a user or create a new user with the same group, but squid does not pick up these changes on the go.
Everything works after systemctl restart squid.
How can you get around this?
Thank you.

Answer 1

Change the value of ttl. You currently have responses cached for 1 hour (3600 seconds).