[SSSD] design discussion: Authenticate against cache in SSSD

Pavel Reichl preichl at redhat.com
Wed May 20 14:54:41 UTC 2015



On 05/20/2015 04:51 PM, Pavel Reichl wrote:
>
>
> On 04/22/2015 11:09 AM, Sumit Bose wrote:
> [snip]
>> I wonder what should happen after a local password change. We save 
>> the hash of the new password to the cache but I think we do not 
>> change the last online auth time here. Shall we do cached 
>> authentication with the new password immediately here or shall we go 
>> to the backend at least once to make sure the backend knows about the 
>> new password. I think I would prefer the latter. Please add test with 
>> wrong password as well to check if offline_failed_login_attempts and 
>> offline_failed_login_delay are respected here as well
> How exactly should be offline_failed_login_attempts and 
> offline_failed_login_delay respected?
>
> In my current implementation cached authentication is  tried no matter 
> the value of offline_failed_login_attempt.  If cached authentication 
> fails offline_failed_login_attempt is increased and online 
> authentication is tried. So currently offline_failed_login_delay has 
> no influence for cached authentication. I don't consider this as as a 
> security problem because online authentication is performed for every 
> cached authentication attempt.
Oh, sorry, correct wording should have been "online authentication is 
performed for every *failed* cached authentication attempt"
> Do you agree?
>
>> (I have not doubt about this because the same code patch will be used 
>> but better be on the save side and be able to detect regression 
>> early). As an alternative we might want to send the request to the 
>> backend if cached authentication fails. This would cover the case 
>> where the user changed the password on the server and tries to login 
>> in to a system where the cached_authentication_timeout is not expired 
>> yet with the new password.
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel




More information about the sssd-devel mailing list