[SSSD] [PATCH] Add support for offline auth cache timeout

Stephen Gallagher stephen at gallagherhome.com
Tue Oct 20 22:04:14 UTC 2009


I was extending it to behave the same way that the NSS responder does.
Previously we didn't have any PAM-specific confdb options, so we never
had a global PAM context.

On Oct 20, 2009, at 4:52 PM, Simo Sorce <ssorce at redhat.com> wrote:

> On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
>> On 10/20/2009 12:19 PM, Sumit Bose wrote:
>>> On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
>>>> On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
>>>>> This patch addresses: https://fedorahosted.org/sssd/ticket/60
>>>>>
>>>>> This adds a new option to the [PAM] section of the sssd.conf.
>>>>>
>>>>> It can be specified by seconds, minutes, hours or days and defines
>>>>> how long a user can perform offline authentications. If the user
>>>>> does not perform an online authentication within the timeout, they
>>>>> will be denied auth once the timeout passes.
>>>>>
>>>> Whoops, found a minor issue. Had the wrong option in the
>>>> sssd.api.conf,
>>>> and I also extended the manpage to describe the timeout options
>>>> better.
>>>>
>>>
>>> NACK,
>>>
>>> as discussed on irc I think it makes sense to check if the current
>>> domain isn't LOCAL and cache credential are enabled for the current
>>> domain before writing the last online auth time.
>>>
>>
>> Changes made as requested. Thank you for the review.
>
> Sorry had no time to to a full review (will do later) but I saw a
> lot of
> changes with the inclusion of a pam_ctx structure, why did you
> introduce
> that instead of extending the rctx structure ?
>
> Simo.
>
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel



More information about the sssd-devel mailing list