This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
-- Stephen Gallagher RHCE 804006346421761
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
bye, Sumit
On 10/20/2009 12:19 PM, Sumit Bose wrote:
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
-- Stephen Gallagher RHCE 804006346421761
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
bye, Sumit _______________________________________________ sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Changes made as requested. Thank you for the review.
On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
On 10/20/2009 12:19 PM, Sumit Bose wrote:
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
Changes made as requested. Thank you for the review.
Sorry had no time to to a full review (will do later) but I saw a lot of changes with the inclusion of a pam_ctx structure, why did you introduce that instead of extending the rctx structure ?
Simo.
I was extending it to behave the same way that the NSS responder does. Previously we didn't have any PAM-specific confdb options, so we never had a global PAM context.
On Oct 20, 2009, at 4:52 PM, Simo Sorce ssorce@redhat.com wrote:
On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
On 10/20/2009 12:19 PM, Sumit Bose wrote:
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
Changes made as requested. Thank you for the review.
Sorry had no time to to a full review (will do later) but I saw a lot of changes with the inclusion of a pam_ctx structure, why did you introduce that instead of extending the rctx structure ?
Simo.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
On 10/20/2009 06:04 PM, Stephen Gallagher wrote:
I was extending it to behave the same way that the NSS responder does. Previously we didn't have any PAM-specific confdb options, so we never had a global PAM context.
On Oct 20, 2009, at 4:52 PM, Simo Sorce ssorce@redhat.com wrote:
On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
On 10/20/2009 12:19 PM, Sumit Bose wrote:
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
This patch addresses: https://fedorahosted.org/sssd/ticket/60
This adds a new option to the [PAM] section of the sssd.conf.
It can be specified by seconds, minutes, hours or days and defines how long a user can perform offline authentications. If the user does not perform an online authentication within the timeout, they will be denied auth once the timeout passes.
Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
Changes made as requested. Thank you for the review.
Sorry had no time to to a full review (will do later) but I saw a lot of changes with the inclusion of a pam_ctx structure, why did you introduce that instead of extending the rctx structure ?
Simo.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
As per discussion on IRC, I'm removing the confdb_get_timeout() code for now, as we need to spend some more time figuring out how to have it work with other timeout.
I have split out the pam_ctx addition and the credential expiration into two separate patches.
Also renamed the option to "offline_credentials_expiration" as recommended by Simo and Jenny.
On 10/22/2009 12:04 PM, Stephen Gallagher wrote:
On 10/20/2009 06:04 PM, Stephen Gallagher wrote:
I was extending it to behave the same way that the NSS responder does. Previously we didn't have any PAM-specific confdb options, so we never had a global PAM context.
On Oct 20, 2009, at 4:52 PM, Simo Sorce ssorce@redhat.com wrote:
On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
On 10/20/2009 12:19 PM, Sumit Bose wrote:
On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
On 10/20/2009 10:37 AM, Stephen Gallagher wrote: > This patch addresses: https://fedorahosted.org/sssd/ticket/60 > > This adds a new option to the [PAM] section of the sssd.conf. > > It can be specified by seconds, minutes, hours or days and defines > how long a user can perform offline authentications. If the user > does not perform an online authentication within the timeout, they > will be denied auth once the timeout passes. > Whoops, found a minor issue. Had the wrong option in the sssd.api.conf, and I also extended the manpage to describe the timeout options better.
NACK,
as discussed on irc I think it makes sense to check if the current domain isn't LOCAL and cache credential are enabled for the current domain before writing the last online auth time.
Changes made as requested. Thank you for the review.
Sorry had no time to to a full review (will do later) but I saw a lot of changes with the inclusion of a pam_ctx structure, why did you introduce that instead of extending the rctx structure ?
Simo.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
As per discussion on IRC, I'm removing the confdb_get_timeout() code for now, as we need to spend some more time figuring out how to have it work with other timeout.
I have split out the pam_ctx addition and the credential expiration into two separate patches.
Also renamed the option to "offline_credentials_expiration" as recommended by Simo and Jenny.
sssd-devel mailing list sssd-devel@lists.fedorahosted.org https://fedorahosted.org/mailman/listinfo/sssd-devel
Whoops, forgot to convert days to seconds. New patch 0004 attached.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 10/22/2009 03:05 PM, Simo Sorce wrote:
On Thu, 2009-10-22 at 12:09 -0400, Stephen Gallagher wrote:
Whoops, forgot to convert days to seconds. New patch 0004 attached.
ack to both.
Simo.
Pushed to master.
- -- Stephen Gallagher RHCE 804006346421761
Looking to carve out IT costs? www.redhat.com/carveoutcosts/
sssd-devel@lists.fedorahosted.org
-
Simo Sorce -
Stephen Gallagher -
Stephen Gallagher -
Sumit Bose