[SSSD-users] Using SSSD Cache When Online

Jakub Hrozek jhrozek at redhat.com
Mon Sep 29 09:47:38 UTC 2014


On Sat, Sep 27, 2014 at 10:02:19AM -0400, Simo Sorce wrote:
> On Fri, 26 Sep 2014 19:50:14 -0400
> Matt Hughes <hughes.matt at gmail.com> wrote:
> 
> > I have an Nginx server that uses a PAM module for authorization. PAM
> > module talks to SSSD which talks to an LDAP server. Currently, every
> > request to the web server ends up making a request to the LDAP
> > server. I’m trying to take advantage of SSSD’s caching mechanisms to
> > improve response time.
> > 
> > I know the SSSD cache works because if I block my connection to the
> > LDAP server, my requests still complete, and very quickly. What I’d
> > like is to be able to use this cache even if the LDAP server is
> > marked as ‘working’.
> > 
> > My pam file is:
> > 
> > auth    required pam_sss.so
> > account required pam_sss.so
> > I was hoping this flag is what I wanted:
> > 
> > entry_cache_timeout (integer)
> >     How many seconds should nss_sss consider entries valid before
> > asking the backend again
> > 
> >     Default: 5400  
> > My reading of that is SSSD wouldn’t go back to the LDAP server for
> > the same user until 5400 seconds have occurred. Is that incorrect? I
> > have that set (along with cache_credentials=true) and I can only get
> > it to read from cache if it thinks the server is down.
> > 
> > Here is my full sssd.conf file:
> > https://gist.github.com/matthughes/05aaeaf276fe5ecafddc
> 
> The cache timeout applies to everything except authentication.
> You are looking for this ticket to be implemented:
> https://fedorahosted.org/sssd/ticket/1807

Right.

I'm afraid the fix won't make 1.12.x because our capacity is full
already, sorry. But given this is the second time this fix was requested
in a single week, it is one of the very high priority items for 1.13.

We would also be happy to review and accept a patch from external
contributor!


More information about the sssd-users mailing list