-----BEGIN PGP SIGNED MESSAGE-----
On 08/23/2010 06:00 AM, Eric Doutreleau wrote:
Does enumeration permit to store credentials for people that have never
logged in the machine?
No, this cannot be done. Assuming that the LDAP server is configured
properly (where the password hashes are unreadable to anyone but
Directory Manager), there would be no way for SSSD to request them for
The way SSSD works is that it takes in the requested password and uses
it to perform the authentication. If the authentication server is
reachable and the password works, then we hash it and store it in our
cache. So the only way to establish cached credentials is to log in at
least once while the authentication server is reachable (e.g., be on the
We will never support pre-enumerating the passwords, even if the LDAP
server was configured (poorly) to make the passwords readable.
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
-----END PGP SIGNATURE-----