On Fri, 2011-08-19 at 14:07 -0400, Dmitri Pal wrote:
I think you are wrong and there use cases when the timeout should be
different. But I will stop insisting.
And IMO if the auth can't go without the internal ID lookup is also
wrong. It should be an option to trust the auth server to do the right
thing and use id from cache.
This is absolutely wrong. The reason for the forced ID lookup is because
you need to be sure that access-control rules are up-to-date. Those
access-control rules are not available to the auth server in many cases
(one such example is HBAC; consider a firewall issue or DS crash). It's
a security vulnerability to rely on online authentication and cached
access-control rules at the same time.
Other common examples would be classic LDAP/kerberos authentication
using either the simple access provider or pam_access. If the user's
group list has changed since the cache was updated, we could potentially
be granting access where it should now have been removed.
If the identity server is offline, we MUST work only with what we have
in the cache. This means using cached auth instead of online auth. (The
advantage here with Kerberos is that it means they aren't being granted
a TGT either).