On Wed, Jul 30, 2014 at 11:07:01AM +0200, Daniel Gollub wrote:
But this would require restart of sssd each time one would add a new
(e.g.) VPN endpoint - right?
Right, is that something you would do regularly, though and not a
one-off thing when you set up your infrastructure.
Right now it is quite convinced that one just can change
the /etc/pam.d/* configuration without requiring to restart/reload the
PAM-enabled service (e.g. VPN daemon) which authenticates against
pam_sss. And also not requiring to restart sssd during business hours
or so.
There is no "reload" configuration functionality in sssd yet - right?
Correct, we tried and failed, reloading configuration on the fly is
much harder to implement correctly than it seems.