[SSSD] [PATCH] Two minor enhancements on using the negative cache in the PAM responder

Ondrej Kos okos at redhat.com
Wed Aug 7 11:37:21 UTC 2013


On 08/07/2013 12:04 PM, Jakub Hrozek wrote:
> Hi,
>
> Yassir who was going through the PAM code recently pointed out two
> strange issues with the PAM responder's usage of negative cache. Please
> see the attached patches for more details, but simplified version is:
>
>   1) The negative cache was only ever checked for domainless searches
>   2) The negative cache was only checked, never set
>
> I don't think this is a pressing issue because in most occasions, the
> negative cache would be hit by the application calling getpwnam() and so
> the PAM responder would not be called at all, but I think the code
> should at least be consistent.
>
> The alternative is of course to stop using negative cache in the PAM
> respnder completely, but I think it has some benefit if the application
> would only call the PAM conversation.

Both patches apply cleanly and fix the issue

Ack to both


-- 
Ondrej Kos
Associate Software Engineer
Identity Management - SSSD
Red Hat Czech



More information about the sssd-devel mailing list