On 02/01/2017 11:15 AM, Pavel Březina wrote:
On 02/01/2017 10:39 AM, Fabiano Fidêncio wrote:
> I've done a first WIP patch for this matter but Jakub pointed out the
> approach is not correct as the PAM doesn't use the cache the same way
> as other responders do.
The patch uses wrong function, please use
cache_req_initgroups_by_name(). (I'm sorry I didn't notice this earlier,
I really barely read it in the private mail).
>
> Differently from the other responders, PAM tries to conatct the Data
> Provider on almost every request.
>
> Looking at the code, what's done is:
> - While looping the domains in pam_check_user_search():
> - call pam_initgr_check_timeout()
> - in case the timeout is still valid:
> - get the entry from sysdb
> - otherwise
> - call the data provider first
The timeout is there to ensure that we don't go to id provider too often
(default 5 seconds) since PAM prefer to always go there and does not
obey entry expiration time.
The whole point of this is to perform initgroups to refresh user's
membership, we are not interested in the result.
I looked at wrong variable, we use user's name from the result since
login name might be alias or upn. Therefore this is the solution.
The most generic solution here is to give cache_req the ability
(parameter) to choose whether we wan't to go to data provider first and
ignore expiration time and make the caller responsible for this decision.
The seconds solution is to create new initgroups plugin for PAM with
bypass_cache = true and decide in PAM if it is called or not.
> As the using cache_req code for PAM responder has two main goals
> (decrease code duplicaton and make it possible to log in with a
> shortname to a trusted domain) Jakub suggested to, maybe write a new
> cache_req plugin (specifically for PAM?) and decrease the number of
> duplicated code by just reusing this new code from cache_req.
>
> The main reason behind his idea is that he thinks we want to keep the
> pam_initgr_check_timeout() while looping the domains in the cache_req
> code.
>
> So, as I'm not that much familiar with none of those two pieces of
> code ... I'd like to know what's Pavel Březina opinion on these ideas.
>
> Best Regards,
> --
> Fabiano Fidêncio
>
_______________________________________________
sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org