Hi All,
I did more research and testing today.
1. For the third question, the answer is NO. offline_credentials_expiration
starts from last successful online login
2. Another testing:
1) cache_credentials = True, account_cache_expiration = 2,
offline_credentials_expiration = 1, cache_entry_timeout=60
2) Use user1 to login
3) After 5 mins (the entry in the sysdb should be expired by then), I shut
down the LDAP server
4) Login as user1 successful
5) id user1 still returns
*My Question:*
Assumption 1: even user entry in the sysdb is expired before sssd enters
offline mode, sssd will still use the expired cache
Assumption 2: cache will only be deleted from the sysdb when backend
couldn't find the entry in the remote domain OR account_cache_expiration is
reached.
Are these assumption correct ?
Thanks,
Aaron
On Tue, Dec 15, 2015 at 11:57 AM, aaron wang <arraonatwork(a)gmail.com> wrote:
Hi All,
1. I plan to enable cache_credential flag in the system, and it looks like
that "account_cache_expiration", "offline_credentials_expiration",
"offline_failed_login_attempts". These three options needs to be set as
well, as their default value is unlimited, which may bring some security
concerns.
Is there any other options I need to take care if I want to enable offline
authentication ?
2. Also, I have some doubt about the difference between
"account_cache_expiration" and "offline_credentials_expiration". I
know
"account_cache_expiration" is per domain, but
"offline_credentials_expiration" is for PAM responder.
E.g. I set account_cache_expiration to 10 days,
offline_credentials_expiration to 2 days. What's the use case of the cache
after day 2 ?
3. Both "offline_credentials_expiration" and
"account_cache_expiration"
are counted after last successful login. Does the successful login after
LDAP offline count ? Will the successful login after LDAP offline extend
the life of the cache ?
Thanks for any information.
Thanks,
Aaron