From fedfc4fa5978dc0ef2c3b6efcd1e9462a8575b3a Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Thu, 7 Mar 2019 22:13:32 +0100 Subject: [PATCH] SYSDB: Inherit cached_auth_timeout from the main domain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cached_auth_timeout is a domain option used by the responder. And because at the moment the options read from a subdomain section (e.g. [domain/main/trusted] are only those represented by the back end specific dp_option structure instance, the option cached_auth_timeout, which is directly read from the confdb was not set for the main domain. This is a minimal patch that just inherits the option from the main domain until SSSD has a more systematic way of inheriting config attributes regardless of how they are read and set. Resolves: https://pagure.io/SSSD/sssd/issue/3960 Reviewed-by: Pavel Březina (cherry picked from commit 4dd268333ca9ca13555f5dfbd2928154b885a3e7) --- src/db/sysdb_subdomains.c | 1 + src/man/sssd.conf.5.xml | 5 +++++ 2 files changed, 6 insertions(+) diff --git a/src/db/sysdb_subdomains.c b/src/db/sysdb_subdomains.c index e380e6c8b..34d052fdd 100644 --- a/src/db/sysdb_subdomains.c +++ b/src/db/sysdb_subdomains.c @@ -154,6 +154,7 @@ struct sss_domain_info *new_subdomain(TALLOC_CTX *mem_ctx, dom->cache_credentials = parent->cache_credentials; dom->cache_credentials_min_ff_length = parent->cache_credentials_min_ff_length; + dom->cached_auth_timeout = parent->cached_auth_timeout; dom->case_sensitive = false; dom->user_timeout = parent->user_timeout; dom->group_timeout = parent->group_timeout; diff --git a/src/man/sssd.conf.5.xml b/src/man/sssd.conf.5.xml index ef5a4b952..41ba7b924 100644 --- a/src/man/sssd.conf.5.xml +++ b/src/man/sssd.conf.5.xml @@ -2962,6 +2962,11 @@ subdomain_inherit = ldap_purge_cache_timeout authenticated using cached credentials while SSSD is in the online mode. + + This option's value is inherited by all trusted + domains. At the moment it is not possible to set + a different value per trusted domain. + Special value 0 implies that this feature is disabled. -- 2.19.1