[SSSD] Hash table for PAM requests
Stephen Gallagher
sgallagh at redhat.com
Thu Oct 7 11:59:49 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 10/07/2010 07:53 AM, Jan Zelený wrote:
> Hi,
> I have a question regarding PAM responder. I'm currently working on
> implementation of a hash table for PAM requests (ticket #533). I have done a
> large part, but now I found something which made me curios about the whole
> concept of my implementation.
>
> I'm assuming PAM responder works this way:
> 1) Receive PAM request
> 2) Delegate it to all domains
> 3) If any domain is marked as offline, ask the domain cache for that record
>
> I've implemented the hash table to be used for requests going to domain
> providers, not the local ones (i.e. those which are going to cache). I think
> in the context of the ticket #533 this is the right approach, because when the
> domain is offline, I won't get a kerberos ticket anyway, so there is no way that
> two users simultaneously logging in will get two credential cache files. Or do
> you think I should implement it for both domain and cache requests in case the
> domain goes online after the first but before the second request?
>
> Thanks for any advice
During offline operation, we still call out to the kerberos child to
create a "fake" credential cache (essentially it creates a cache with a
TGT that is expired). This is so that it behaves properly with regards
to krb5-auth-dialog.
So even when we're offline, we want to control this access to ensure
that we don't end up with divergent credential caches.
- --
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/
iEYEARECAAYFAkyttjUACgkQeiVVYja6o6NqOQCfRF52V8C57BmK3DcKh2OSAr/e
cPEAnAjuhpWjc56GKJfnm2Y1UW8S9owy
=w+Jh
-----END PGP SIGNATURE-----
More information about the sssd-devel
mailing list