On 10/20/2009 06:04 PM, Stephen Gallagher wrote:
> I was extending it to behave the same way that the NSS responder does.
> Previously we didn't have any PAM-specific confdb options, so we never
> had a global PAM context.
>
> On Oct 20, 2009, at 4:52 PM, Simo Sorce <ssorce(a)redhat.com> wrote:
>
>> On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
>>> On 10/20/2009 12:19 PM, Sumit Bose wrote:
>>>> On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
>>>>> On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
>>>>>> This patch addresses:
https://fedorahosted.org/sssd/ticket/60
>>>>>>
>>>>>> This adds a new option to the [PAM] section of the sssd.conf.
>>>>>>
>>>>>> It can be specified by seconds, minutes, hours or days and
defines
>>>>>> how long a user can perform offline authentications. If the user
>>>>>> does not perform an online authentication within the timeout,
they
>>>>>> will be denied auth once the timeout passes.
>>>>>>
>>>>> Whoops, found a minor issue. Had the wrong option in the
>>>>> sssd.api.conf,
>>>>> and I also extended the manpage to describe the timeout options
>>>>> better.
>>>>>
>>>>
>>>> NACK,
>>>>
>>>> as discussed on irc I think it makes sense to check if the current
>>>> domain isn't LOCAL and cache credential are enabled for the current
>>>> domain before writing the last online auth time.
>>>>
>>>
>>> Changes made as requested. Thank you for the review.
>>
>> Sorry had no time to to a full review (will do later) but I saw a
>> lot of
>> changes with the inclusion of a pam_ctx structure, why did you
>> introduce
>> that instead of extending the rctx structure ?
>>
>> Simo.
>>
>>
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel(a)lists.fedorahosted.org
>>
https://fedorahosted.org/mailman/listinfo/sssd-devel
> _______________________________________________
> sssd-devel mailing list
> sssd-devel(a)lists.fedorahosted.org
>
https://fedorahosted.org/mailman/listinfo/sssd-devel
As per discussion on IRC, I'm removing the confdb_get_timeout() code for
now, as we need to spend some more time figuring out how to have it work
with other timeout.
I have split out the pam_ctx addition and the credential expiration into
two separate patches.
Also renamed the option to "offline_credentials_expiration" as
recommended by Simo and Jenny.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel
Whoops, forgot to convert days to seconds. New patch 0004 attached.
--
Stephen Gallagher
RHCE 804006346421761
Looking to carve out IT costs?