[SSSD] [PATCH] ipa-server-mode: add IPA group memberships to AD users

Jakub Hrozek jhrozek at redhat.com
Mon Aug 26 19:58:37 UTC 2013


On Mon, Aug 26, 2013 at 03:35:09PM -0400, Simo Sorce wrote:
> The point of checking initgroups at login is to assure the right
> memberships are in place, both for security reasons and to allow a user
> to logoff and login back again and make sure eh gets new group
> memberships if he has been granted any new ones.
> 
> Loggin off then back on is the only way to gain system-wide the new
> memberships so that's what an administrator will tell a user to do if
> the user complains he can't access something.
> 
> This means that caching can't last long as the side effects are severe.
> So anything more than a few seconds would probably be bad. A few seconds
> make total sense for load issues when someone is abusing pam atuh (for
> example someon eusing basic auth wired to pam auth for a a web server
> that will receive potentially many tens of authentications for the same
> user within a fraction of a second as each image and file is loaded in a
> new connection).
> 
> In this case you really want to completely cache the whole operation and
> not touch the network for any reason, otherwise latency will make things
> unbearable. But that's the extent to which you want to go, a few seconds
> for auth bursts, nothing more.

Just for completeness, we do have code in the PAM responder to cache
login-time initgroups (as opposed to running id -G for instance) for 5
seconds to account for login bursts.



More information about the sssd-devel mailing list