[SSSD-users] Caching credentials while online

Dmitri Pal dpal at redhat.com
Fri Aug 15 08:11:19 UTC 2014


On 08/15/2014 01:18 AM, Jacob Weber wrote:
>> Can you file a RFE?
> Sure: https://fedorahosted.org/sssd/ticket/2408
>
>> Could you check in the logs what takes the longest during the whole
>> request? If your server is really fast, maybe you can add
>> debug_microseconds to the config file to increase the resolution..
> I tried, but I'm not seeing a particular area that's slower than others. I can try looking more carefully when I have some time.
>
> The lookup doesn't make a huge difference in one request, but it adds up.
>
> In particular, this machine runs Subversion over Apache, and authenticates against the system users (using SSSD). Unfortunately SVN over Apache makes a ton of separate requests. Since SSSD doesn't cache, I'm probably going to look into having Apache use a method that does, like mod_ldap.
>
>> Maybe the new option could cover both the initgroups and authentication,
>> not sure. It's a bit of slippery slope, because on a Linux system
>> authentication is actually the only moment where groups are set. On the
>> other hand, group membership don't change that often..
> Plus, if you're doing offline caching, you're already going down that slope...
>
> Jacob
> _______________________________________________
> sssd-users mailing list
> sssd-users at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-users

Is this just authentication?
Because if it is you might consider things like SSO.
Kerberos for example.
While mod_auth_kerb would do the renegotiation on every request which 
most likely be a bit slow the new module mod_auth_gssapi has session 
support that sets cookies after the initial negotiation. That should be 
much faster and I expect it to need your requirement.
Have you considered this as an alternative?
If you need more details of how that all works let me know.

-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager IdM portfolio
Red Hat, Inc.



More information about the sssd-users mailing list