On Mon, 2011-05-23 at 19:20 -0400, Dmitri Pal wrote:
But this means that on any first attempt by a foreign user to access
a
RHEL system we might either fail to determine the right domain since the
time to sort things out might be long enough and we will give up and
return an error to the caller or we would have to block. I am not sure
either is acceptable.
This would happen only the first time a client from that domain would
try to access the system, *if* the call is slow, and *if* we never had
enumerated that domain for other reasons before.
Since then we have caching.
I agree that polling is very costly but being able to respond right
away
on any client half an hour after the relation is defined is much better
than failing when user accessed a resource he never accessed before.
For the first time a user connect to a new resource I think a minimum
delay is acceptable. If we find out that this is actually more then a
short delay, then we can try to add workarounds.
Simo.
--
Simo Sorce * Red Hat, Inc * New York