This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines
how long a user can perform offline authentications. If the user
does not perform an online authentication within the timeout, they
will be denied auth once the timeout passes.
Looking to carve out IT costs?