[SSSD] [PATCH] Cache initgroup calls and use them in pam responder

Simo Sorce ssorce at redhat.com
Thu Nov 12 03:12:46 UTC 2009


These patches improve the initgroups call.
Previously any call to initgroups would go on the wire, now we cache
initgroups calls the same way we do for other "queries".

0001 Adds initgroups caching (depends on check_cache patch sent earlier)
This patch also simplifies the initgroups call. All backends already do
a search for the user, so doing an explicit user search in the nss
responder is pointless and wastes time.

0002 Change the pam code to do an online initgroups call instead of a
search user call, an initgroups call also does a user search call, plus
it also fetches all users groups so that, at login, access control
against groups can be done against a properly refreshed group list.

0003 Store the initgroups expire time in the ldap driver.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Change-initgroups-code-to-use-and-check-the-cache.patch
Type: text/x-patch
Size: 17462 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091112/f477526d/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Change-the-pam-code-to-perform-an-initgroups-call.patch
Type: text/x-patch
Size: 1175 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091112/f477526d/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0003-Store-initgr-expire-time-on-initgr-call.patch
Type: text/x-patch
Size: 3264 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091112/f477526d/attachment-0002.bin>


More information about the sssd-devel mailing list