[SSSD] Hash table for PAM requests

Jan Zelený jzeleny at redhat.com
Thu Oct 7 11:53:28 UTC 2010


Hi,
I have a question regarding PAM responder. I'm currently working on 
implementation of a hash table for PAM requests (ticket #533). I have done a 
large part, but now I found something which made me curios about the whole 
concept of my implementation.

I'm assuming PAM responder works this way:
1) Receive PAM request
2) Delegate it to all domains
3) If any domain is marked as offline, ask the domain cache for that record

I've implemented the hash table to be used for requests going to domain 
providers, not the local ones (i.e. those which are going to cache). I think 
in the context of the ticket #533 this is the right approach, because when the 
domain is offline, I won't get a kerberos ticket anyway, so there is no way that 
two users simultaneously logging in will get two credential cache files. Or do 
you think I should implement it for both domain and cache requests in case the 
domain goes online after the first but before the second request?

Thanks for any advice

Jan



More information about the sssd-devel mailing list