URL:
https://github.com/SSSD/sssd/pull/804
Title: #804: PAM: Also cache SSS_PAM_PREAUTH
jhrozek commented:
"""
Thank you for the comments, here is the diff:
```
diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml
index c12fef731..03d3a104c 100644
--- a/src/man/sssd.conf.5.xml
+++ b/src/man/sssd.conf.5.xml
@@ -3046,7 +3046,9 @@ subdomain_inherit = ldap_purge_cache_timeout
Specifies time in seconds since last successful
online authentication for which user will be
authenticated using cached credentials while
- SSSD is in the online mode.
+ SSSD is in the online mode. If the credentials
+ are incorrect, SSSD falls back to online
+ authentication.
</para>
<para>
This option's value is inherited by all trusted
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index a70b342b1..89bdb78a1 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -808,8 +808,9 @@ static void pam_reply(struct pam_auth_req *preq)
pam_verbosity = DEFAULT_PAM_VERBOSITY;
}
- DEBUG(SSSDBG_FUNC_DATA,
- "pam_reply called with result [%d]: %s.\n",
+ DEBUG(SSSDBG_TRACE_ALL,
+ "pam_reply initially called with result [%d]: %s. "
+ "this result might be changed during processing\n",
pd->pam_status, pam_strerror(NULL, pd->pam_status));
if (pd->cmd == SSS_PAM_AUTHENTICATE
@@ -891,6 +892,7 @@ static void pam_reply(struct pam_auth_req *preq)
break;
/* TODO: we need the pam session cookie here to make sure that cached
* authentication was successful */
+ case SSS_PAM_PREAUTH:
case SSS_PAM_SETCRED:
case SSS_PAM_ACCT_MGMT:
case SSS_PAM_OPEN_SESSION:
@@ -1072,6 +1074,8 @@ static void pam_reply(struct pam_auth_req *preq)
}
done:
+ DEBUG(SSSDBG_FUNC_DATA, "Returning [%d]: %s to the client\n",
+ pd->pam_status, pam_strerror(NULL, pd->pam_status));
sss_cmd_done(cctx, preq);
}
@@ -2022,8 +2026,7 @@ static bool pam_can_user_cache_auth(struct sss_domain_info
*domain,
return false;
}
- if (domain->cache_credentials == false
- || domain->cached_auth_timeout <= 0) {
+ if (!domain->cache_credentials || domain->cached_auth_timeout <= 0) {
return false;
}
```
"""
See the full comment at
https://github.com/SSSD/sssd/pull/804#issuecomment-493042534