If a user tries to access a project before they are a member, they'll be stored in the negative nscd cache for group. When the user is added to the project, if they try to access the instance before the negative cache expires, they'll be rejected.
Using salt, we should trigger an nscd group cache invalidation for all instances in a project when a user is added or removed from the project.
Version: unspecified
Severity: normal