[SSSD] [PATCH] Cache initgroup calls and use them in pam responder

Stephen Gallagher sgallagh at redhat.com
Wed Nov 18 22:37:11 UTC 2009


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/18/2009 11:24 AM, Stephen Gallagher wrote:
> On 11/11/2009 10:12 PM, Simo Sorce wrote:
>> These patches improve the initgroups call.
>> Previously any call to initgroups would go on the wire, now we cache
>> initgroups calls the same way we do for other "queries".
> 
>> 0001 Adds initgroups caching (depends on check_cache patch sent earlier)
>> This patch also simplifies the initgroups call. All backends already do
>> a search for the user, so doing an explicit user search in the nss
>> responder is pointless and wastes time.
> 
>> 0002 Change the pam code to do an online initgroups call instead of a
>> search user call, an initgroups call also does a user search call, plus
>> it also fetches all users groups so that, at login, access control
>> against groups can be done against a properly refreshed group list.
> 
>> 0003 Store the initgroups expire time in the ldap driver.
> 
>> Simo.
> 
> 
> 
> 
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/sssd-devel
> 
> Ack to all three.
> 

Pushed to master


_______________________________________________
sssd-devel mailing list
sssd-devel at lists.fedorahosted.org
https://fedorahosted.org/mailman/listinfo/sssd-devel

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAksEdxcACgkQeiVVYja6o6MHdACeIuyFhT/AX4zU5HXhwtIFI+e6
hdsAn2Z+3FK3y8qXQfhbz7O/1a0uPARi
=vxqa
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list