[SSSD] [PATCH] Serialize authentication requests
Sumit Bose
sbose at redhat.com
Tue Oct 19 08:50:12 UTC 2010
On Fri, Oct 15, 2010 at 02:13:05PM +0200, Jan Zelený wrote:
> I'm sending a patch which is resolving ticket #533 by implementing a hash
> table into the PAM responder.
>
> For testing I followed this approach:
> 0) Configure sssd to use RH LDAP and KRB
> 1) Activate shaping on the host computer
> tc qdisc add dev eth0 root netem delay 2s
> 2) Run 2 separate shells with non-root user logged in
> 3) In both shells run su - <login> simultaneously
> 4) When asked for password, type in your password, but don't hit enter
> 5) When you have a password typed in both shells, hit enter in the first one,
> quickly switch to the other one and hit enter there (you should have 2s window
> to do this)
>
> In both shells you should be logged in as <login> and you should have the same
> ticket cache file.
>
> Something about the concept: I took it from NSS responder (or rather the
> common part, which retrieves information about user) as suggested in the
> ticket. But as Jakub pointed out to me, it is questionable whether we want to
> invoke all associated callbacks by scheduling them on the same time. The
> easier alternative is to call them all one after another in a cycle. I suppose
> it was implemented this way so it doesn't take long to forward all associated
> replies and other requests from PAM module can be served. Am I right? Or would
> it be better to re-write the patch and use the cycle instead?
>
> Thanks
> Jan
We have decided to take a different approach to solve #533, see
https://fedorahosted.org/sssd/ticket/533#comment:7 for details.
Nevertheless I have two comments:
- instead of using tevent_add_timer() with the current time it might
make sense to use tevent_schedule_immediate() here
- instead of using hash_create() you should use sss_hash_create(), because
hash_create() will use malloc() to allocate memory and not talloc
bye,
Sumit
More information about the sssd-devel
mailing list