[SSSD] Hash table for PAM requests

Stephen Gallagher sgallagh at redhat.com
Thu Oct 7 11:59:49 UTC 2010


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/07/2010 07:53 AM, Jan Zelený wrote:
> Hi,
> I have a question regarding PAM responder. I'm currently working on 
> implementation of a hash table for PAM requests (ticket #533). I have done a 
> large part, but now I found something which made me curios about the whole 
> concept of my implementation.
> 
> I'm assuming PAM responder works this way:
> 1) Receive PAM request
> 2) Delegate it to all domains
> 3) If any domain is marked as offline, ask the domain cache for that record
> 
> I've implemented the hash table to be used for requests going to domain 
> providers, not the local ones (i.e. those which are going to cache). I think 
> in the context of the ticket #533 this is the right approach, because when the 
> domain is offline, I won't get a kerberos ticket anyway, so there is no way that 
> two users simultaneously logging in will get two credential cache files. Or do 
> you think I should implement it for both domain and cache requests in case the 
> domain goes online after the first but before the second request?
> 
> Thanks for any advice

During offline operation, we still call out to the kerberos child to
create a "fake" credential cache (essentially it creates a cache with a
TGT that is expired). This is so that it behaves properly with regards
to krb5-auth-dialog.

So even when we're offline, we want to control this access to ensure
that we don't end up with divergent credential caches.

- -- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkyttjUACgkQeiVVYja6o6NqOQCfRF52V8C57BmK3DcKh2OSAr/e
cPEAnAjuhpWjc56GKJfnm2Y1UW8S9owy
=w+Jh
-----END PGP SIGNATURE-----



More information about the sssd-devel mailing list