On Wed, Dec 27, 2017 at 10:47:20AM +0800, Lin Yuan wrote:

Hello SSSD experts

I am a bit confused about the relationship between these 2 parameters.

In my setup test, it seems there 2 parameters are independent. If I set "cached_auth_timeout" longer than "entry_cache_timeout", when "entry_cache_timeout" expires and "cached_auth_timeout" not, I can still login with cached credentials.

Yes, both parameters are independent.

Even if I clean all cache by "sss_cache -E", login with cached credentials still work as long as it is within the timeout period.

So my questions

• where is cached credential stored? Is it also the /var/lib/sss/db/* ?

Yes

Then why it cannot be invalidated by "sss_cache -E"?

• how can I invalidate it without restarting the sssd service?

Currently there is no easy way. The main reason is that the cached credentials are used to allow offline authentication, i.e. to be able to authenticate if your LDAP or Kerberos server is not reachable. If the cached credentials would expire automatically there would be a time where you are not able to login anymore if the system is offline. So by default the cached credentials do not expired.

If you want that the cached credentials expire please check offline_credentials_expiration in man sssd.conf.

That said, please note that cached_auth_timeout serves a different purpose. This option will be used if the system is online and gives the time how long the client is allowed to use the cached credentials to authenticate a user without doing an online authentication against the LDAP or Kerberos server. This is mainly for use cases were an application does many authentication attempts of the same user in a short amount of time (think of a poorly designed web application where the user is authentication with every page load).

HTH

bye, Sumit

---

sssd-users mailing list -- sssd-users@lists.fedorahosted.org To unsubscribe send an email to sssd-users-leave@lists.fedorahosted.org