[SSSD] [PATCH] Cache initgroup calls and use them in pam responder

Stephen Gallagher sgallagh at redhat.com
Wed Nov 18 16:24:15 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/11/2009 10:12 PM, Simo Sorce wrote:
> These patches improve the initgroups call.
> Previously any call to initgroups would go on the wire, now we cache
> initgroups calls the same way we do for other "queries".
> 
> 0001 Adds initgroups caching (depends on check_cache patch sent earlier)
> This patch also simplifies the initgroups call. All backends already do
> a search for the user, so doing an explicit user search in the nss
> responder is pointless and wastes time.
> 
> 0002 Change the pam code to do an online initgroups call instead of a
> search user call, an initgroups call also does a user search call, plus
> it also fetches all users groups so that, at login, access control
> against groups can be done against a properly refreshed group list.
> 
> 0003 Store the initgroups expire time in the ldap driver.
> 
> Simo.
> 
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel

Ack to all three.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAksEH6oACgkQeiVVYja6o6PNqACeKfTcRgBKPLJVyw4M3VX+QBm/
5CAAn0mzCW4V9viWKlxytS84xfxNfWLO
=RmN2
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list