Hi folks,
is there some way to disable sssd's password cache? Everytime a colleague changes his password, he has problems with our dovecot server, because it runs into a permission denied, until some privileged user runs "sss_cache -u name" or "sss_cache -E" or similar.
AFAIU the password is stored for 5400 seconds. Apparently thats too long. Caching passwords while sssd is connected to LDAP and Kerberos might be considered a bad idea, anyway. There is an undocumented option krb5_store_password_if_offline in sssd.conf. Maybe there are other undocumented options as well?
Regards
Harri
Am Mon, Sep 23, 2024 at 11:45:56AM +0200 schrieb Harald Dunkel via FreeIPA-users:
Hi folks,
is there some way to disable sssd's password cache? Everytime a colleague changes his password, he has problems with our dovecot server, because it runs into a permission denied, until some privileged user runs "sss_cache -u name" or "sss_cache -E" or similar.
AFAIU the password is stored for 5400 seconds. Apparently thats too long. Caching passwords while sssd is connected to LDAP and Kerberos might be considered a bad idea, anyway. There is an undocumented option krb5_store_password_if_offline in sssd.conf. Maybe there are other undocumented options as well?
Hi,
by default SSSD tries to do online authentication as long as SSSD is online, i.e. can reach the server. This behavior can be changed with the `cached_auth_timeout` option which allows SSSD to used the stored password hash for authentication for the time given with the option, see man sssd.conf for details. Did you, by chance, use this option in sssd.conf?
HTH
bye, Sumit
Regards
Harri
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On 2024-09-23 13:15:47, Sumit Bose via FreeIPA-users wrote:
by default SSSD tries to do online authentication as long as SSSD is online, i.e. can reach the server. This behavior can be changed with the `cached_auth_timeout` option which allows SSSD to used the stored password hash for authentication for the time given with the option, see man sssd.conf for details. Did you, by chance, use this option in sssd.conf?
No, cached_auth_timeout is not set. I am not sure if it is relevant here, since the user cannot login using his new password. The cached_auth_timeout seems to be important *after* login for reauthen- tication.
Regards
Harri
Am Tue, Sep 24, 2024 at 08:05:58AM +0200 schrieb Harald Dunkel via FreeIPA-users:
On 2024-09-23 13:15:47, Sumit Bose via FreeIPA-users wrote:
by default SSSD tries to do online authentication as long as SSSD is online, i.e. can reach the server. This behavior can be changed with the `cached_auth_timeout` option which allows SSSD to used the stored password hash for authentication for the time given with the option, see man sssd.conf for details. Did you, by chance, use this option in sssd.conf?
No, cached_auth_timeout is not set. I am not sure if it is relevant here, since the user cannot login using his new password. The cached_auth_timeout seems to be important *after* login for reauthen- tication.
Hi,
then I think we need SSSD debug logs covering a failed login attempt.
bye, Sumit
Regards
Harri
FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-leave@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahoste... Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
On 2024-09-23 11:45:56, Harald Dunkel via FreeIPA-users wrote:
Hi folks,
is there some way to disable sssd's password cache? Everytime a colleague changes his password, he has problems with our dovecot server, because it runs into a permission denied, until some privileged user runs "sss_cache -u name" or "sss_cache -E" or similar.
AFAIU the password is stored for 5400 seconds. Apparently thats too long. Caching passwords while sssd is connected to LDAP and Kerberos might be considered a bad idea, anyway. There is an undocumented option krb5_store_password_if_offline in sssd.conf. Maybe there are other undocumented options as well?
PS: I don't want to disable caching credentials completely. Sssd should recognize *changed* credentials, ie a mismatch between the local cache and the data on the FreeIPA server.
Regards
Harri
freeipa-users@lists.fedorahosted.org