[SSSD] [PATCH] Add support for offline auth cache timeout

Stephen Gallagher sgallagh at redhat.com
Thu Oct 22 16:09:37 UTC 2009


On 10/22/2009 12:04 PM, Stephen Gallagher wrote:
> On 10/20/2009 06:04 PM, Stephen Gallagher wrote:
>> I was extending it to behave the same way that the NSS responder does.
>> Previously we didn't have any PAM-specific confdb options, so we never
>> had a global PAM context.
>>
>> On Oct 20, 2009, at 4:52 PM, Simo Sorce <ssorce at redhat.com> wrote:
>>
>>> On Tue, 2009-10-20 at 16:13 -0400, Stephen Gallagher wrote:
>>>> On 10/20/2009 12:19 PM, Sumit Bose wrote:
>>>>> On Tue, Oct 20, 2009 at 11:15:52AM -0400, Stephen Gallagher wrote:
>>>>>> On 10/20/2009 10:37 AM, Stephen Gallagher wrote:
>>>>>>> This patch addresses: https://fedorahosted.org/sssd/ticket/60
>>>>>>>
>>>>>>> This adds a new option to the [PAM] section of the sssd.conf.
>>>>>>>
>>>>>>> It can be specified by seconds, minutes, hours or days and defines
>>>>>>> how long a user can perform offline authentications. If the user
>>>>>>> does not perform an online authentication within the timeout, they
>>>>>>> will be denied auth once the timeout passes.
>>>>>>>
>>>>>> Whoops, found a minor issue. Had the wrong option in the
>>>>>> sssd.api.conf,
>>>>>> and I also extended the manpage to describe the timeout options
>>>>>> better.
>>>>>>
>>>>>
>>>>> NACK,
>>>>>
>>>>> as discussed on irc I think it makes sense to check if the current
>>>>> domain isn't LOCAL and cache credential are enabled for the current
>>>>> domain before writing the last online auth time.
>>>>>
>>>>
>>>> Changes made as requested. Thank you for the review.
>>>
>>> Sorry had no time to to a full review (will do later) but I saw a
>>> lot of
>>> changes with the inclusion of a pam_ctx structure, why did you
>>> introduce
>>> that instead of extending the rctx structure ?
>>>
>>> Simo.
>>>
>>>
>>> _______________________________________________
>>> sssd-devel mailing list
>>> sssd-devel at lists.fedorahosted.org
>>> https://fedorahosted.org/mailman/listinfo/sssd-devel
>> _______________________________________________
>> sssd-devel mailing list
>> sssd-devel at lists.fedorahosted.org
>> https://fedorahosted.org/mailman/listinfo/sssd-devel
> 
> As per discussion on IRC, I'm removing the confdb_get_timeout() code for
> now, as we need to spend some more time figuring out how to have it work
> with other timeout.
> 
> I have split out the pam_ctx addition and the credential expiration into
> two separate patches.
> 
> Also renamed the option to "offline_credentials_expiration" as
> recommended by Simo and Jenny.
> 
> 
> 
> 
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://fedorahosted.org/mailman/listinfo/sssd-devel

Whoops, forgot to convert days to seconds. New patch 0004 attached.

-- 
Stephen Gallagher
RHCE 804006346421761

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: 0004-Add-support-for-offline-auth-cache-timeout.patch
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091022/53015960/attachment.ksh>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 260 bytes
Desc: OpenPGP digital signature
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091022/53015960/attachment.sig>


More information about the sssd-devel mailing list