[SSSD] how does enumeration work

Stephen Gallagher sgallagh at redhat.com
Mon Aug 23 11:17:24 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 08/23/2010 06:00 AM, Eric Doutreleau wrote:

> 
> Does enumeration permit to store credentials for people that have never 
> logged in the machine?
> 

No, this cannot be done. Assuming that the LDAP server is configured
properly (where the password hashes are unreadable to anyone but
Directory Manager), there would be no way for SSSD to request them for
caching.

The way SSSD works is that it takes in the requested password and uses
it to perform the authentication. If the authentication server is
reachable and the password works, then we hash it and store it in our
cache. So the only way to establish cached credentials is to log in at
least once while the authentication server is reachable (e.g., be on the
corporate network)

We will never support pre-enumerating the passwords, even if the LDAP
server was configured (poorly) to make the passwords readable.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkxyWL8ACgkQeiVVYja6o6PmKQCeNsS+MlxP8bNYJo7XscYRfuOG
UsUAn3bSEVaw7C+DXSWaJ2s8CERD+sE7
=RKYP
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list