[SSSD] design discussion: Authenticate against cache in SSSD

Pavel Reichl preichl at redhat.com
Wed May 20 14:51:13 UTC 2015



On 04/22/2015 11:09 AM, Sumit Bose wrote:
[snip]
> I wonder what should happen after a local password change. We save the 
> hash of the new password to the cache but I think we do not change the 
> last online auth time here. Shall we do cached authentication with the 
> new password immediately here or shall we go to the backend at least 
> once to make sure the backend knows about the new password. I think I 
> would prefer the latter. Please add test with wrong password as well 
> to check if offline_failed_login_attempts and 
> offline_failed_login_delay are respected here as well
How exactly should be offline_failed_login_attempts and 
offline_failed_login_delay respected?

In my current implementation cached authentication is  tried no matter 
the value of offline_failed_login_attempt.  If cached authentication 
fails offline_failed_login_attempt is increased and online 
authentication is tried. So currently offline_failed_login_delay has no 
influence for cached authentication. I don't consider this as as a 
security problem because online authentication is performed for every 
cached authentication attempt.
Do you agree?

> (I have not doubt about this because the same code patch will be used 
> but better be on the save side and be able to detect regression 
> early). As an alternative we might want to send the request to the 
> backend if cached authentication fails. This would cover the case 
> where the user changed the password on the server and tries to login 
> in to a system where the cached_authentication_timeout is not expired 
> yet with the new password.




More information about the sssd-devel mailing list