On Sun, 10 Mar 2019, Albert Szostkiewicz via FreeIPA-users wrote:
Thanks!
But that sounds more like temporary solution for optimization purposes,
but what if we have a person going for lets say 1 month holiday to
remote island without internet ? :) - should i just manually set time
out for over one month?
It doesn't matter how long -- if you enabled offline
authentication,
users who logged in during online period may login in offline mode as
along as their creds are cached.
Sure, they will not get a valid kerberos ticket for that offline auth
but since they aren't able to use it anyway, it would not hurt. Also,
sudo rules can be cached for offline auth.
That's very handy and works very well.
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland