[SSSD] IPA access backend fixes (tickets #565, 567)

Sumit Bose sbose at redhat.com
Wed Jul 21 13:46:05 UTC 2010


On Wed, Jul 21, 2010 at 04:43:41PM +0400, Eugene Indenbom wrote:
> The patch attached fixes issues reported in tickets #565 and 567.
> 
> Eugene

Hi,

I agree with returning PAM_PERM_DENIED instead of PAM_SYSTEM_ERROR, but
I think you remove more entries from the cache then expected. The
response from the LDAP server will only contain information about the
local host and the current remote host (if any). If you delete anything
from the cache except those two (or even only one) entries the offline
access is largely restricted, because there is no data about other
remote hosts in the cache.

One solution to #567 might be to introduce a cleanup task which runs at
regular intervals and checks if there still is a server entry for a
cached object, similar as it is done for users and groups.

bye,
Sumit



More information about the sssd-devel mailing list