[SSSD] [PATCH][PRELIMINARY] sudo: send username and uid while requesting default options
Simo Sorce
simo at redhat.com
Tue Apr 17 18:20:09 UTC 2012
On Tue, 2012-04-17 at 13:37 -0400, Simo Sorce wrote:
> On Tue, 2012-04-17 at 13:29 -0400, Dmitri Pal wrote:
> > On 04/17/2012 12:19 PM, Pavel Březina wrote:
> > > This is what simo and I made up in the last few days:
> > >
> > > https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules
> > >
> > > I tried to go to the details so we can avoid further problems.
> > > Please, review it and tell us what is not good or clear enough.
> > >
> > > Thanks,
> > > Pavel.
> > > _______________________________________________
> > > sssd-devel mailing list
> > > sssd-devel at lists.fedorahosted.org
> > > https://fedorahosted.org/mailman/listinfo/sssd-devel
> >
> > Should we also do per user smart updates when the user runs sudo?
>
> I had that point in the flow, but we decided to pull it out and defer it
> for the first go, and do a simpler implementation.
>
> > Might be costly but probably should be an option. May be when user
> > logs in.
>
> The way to do it was planned to be with storing the last smart update
> time in the user account, and if both this timestamp and the global last
> update timestamp were older than a threshold (5 min?) then we would do a
> smart update as step 1 in B.
This was the first version with the user smart refresh workflow btw:
https://fedorahosted.org/sssd/wiki/DesignDocs/SUDOCachingRules?version=1
> > Should we create a tool to force full refresh of the rules
> > immediately?
> >
> > Yes, eventually, but this can be deferred.
>
> For testing purposes a command to force a full refresh now is very
> valuable as well as for admins, so we should have it as part of the
> first implementation.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list