[SSSD] design discussion: Authenticate against cache in SSSD
Jakub Hrozek
jhrozek at redhat.com
Wed Apr 22 10:02:06 UTC 2015
On Wed, Apr 22, 2015 at 11:09:33AM +0200, Sumit Bose wrote:
> > * extend ''struct pam_auth_req''
> > * add new field `use_cached_auth` (default value is false)
> > * extend ''pam_dom_forwarder()''
> > * obtain value of domain option `cached_authentication_timeout`
>
> I think you can add a new element to pam_ctx for this like we currently
> do this e.g. with id_timeout.
The design page is not too specific about this detail, but I think Pavel
intended to have a per-domain option, which would then make sense to
include in a per-domain data structure, maybe even sss_domain_info.
>
> Please check if cached_authentication_timeout is not larger than
> offline_credentials_expiration (given in days) and use the smaller of
> the two.
More information about the sssd-devel
mailing list