[SSSD-users] Caching credentials while online

Jakub Hrozek jhrozek at redhat.com
Thu Aug 14 19:20:08 UTC 2014


On Thu, Aug 14, 2014 at 12:08:43PM -0700, Jacob Weber wrote:
> Using SSSD with LDAP, is it possible to cache credentials for a period, even while online? I'd like to speed up authentication on certain servers.
> 
> I have cache_credentials = true in sssd.conf. When I authenticate, I can see "Password successfully cached for [username]" in the log file. Then if I go offline, the cache is used. But while I'm online, it contacts the server each time.

Currently this is not possible. But I think we talked about this option
in the past, just never gotten around to implementing this.

Can you file a RFE?

But I'm not sure if this is really what would help speed up the
authentication. In my experience, most of the time spent during what the
user sees as authentication is not the authentication itself, but rather
setting up the list of groups the user is a member of (aka initgroups).

Could you check in the logs what takes the longest during the whole
request? If your server is really fast, maybe you can add
debug_microseconds to the config file to increase the resolution..

Maybe the new option could cover both the initgroups and authentication,
not sure. It's a bit of slippery slope, because on a Linux system
authentication is actually the only moment where groups are set. On the
other hand, group membership don't change that often..


More information about the sssd-users mailing list