[SSSD-users] Re: any relationship between "entry_cache_timeout" and "cached_auth_timeout"?
On Wed, Dec 27, 2017 at 10:47:20AM +0800, Lin Yuan wrote:
Hello SSSD experts
I am a bit confused about the relationship between these 2 parameters.
In my setup test, it seems there 2 parameters are independent. If I set
"cached_auth_timeout" longer than "entry_cache_timeout", when
"entry_cache_timeout" expires and "cached_auth_timeout" not, I can
still
login with cached credentials.
Yes, both parameters are independent.
Even if I clean all cache by "sss_cache -E", login with cached credentials
still work as long as it is within the timeout period.
So my questions
- where is cached credential stored? Is it also the /var/lib/sss/db/* ?
Yes
Then why it cannot be invalidated by "sss_cache -E"?
- how can I invalidate it without restarting the sssd service?
Currently there is no easy way. The main reason is that the cached
credentials are used to allow offline authentication, i.e. to be able to
authenticate if your LDAP or Kerberos server is not reachable. If the
cached credentials would expire automatically there would be a time
where you are not able to login anymore if the system is offline. So by
default the cached credentials do not expired.
If you want that the cached credentials expire please check
offline_credentials_expiration in man sssd.conf.
That said, please note that cached_auth_timeout serves a different
purpose. This option will be used if the system is online and gives the
time how long the client is allowed to use the cached credentials to
authenticate a user without doing an online authentication against the
LDAP or Kerberos server. This is mainly for use cases were an
application does many authentication attempts of the same user in a
short amount of time (think of a poorly designed web application where
the user is authentication with every page load).
HTH
bye,
Sumit
_______________________________________________
sssd-users mailing list -- sssd-users(a)lists.fedorahosted.org
To unsubscribe send an email to sssd-users-leave(a)lists.fedorahosted.org