cache-credentials

[mathias dufresne]

Hi all,

Does "cache-credentials" option need a LDAPS connection or can we set it up
over LDAP too?

Cheers

[Jakub Hrozek]

On Mon, Sep 21, 2015 at 06:09:08PM +0200, mathias dufresne wrote:
>  Hi all,
>  
>  Does "cache-credentials" option need a LDAPS connection or can we set it up
>  over LDAP too?
>  
>  Cheers 
It's quite unrelated. SSSD is built so that authentication never happens
over unencrypted channel -- it's either TLS or LDAPs.

What cache_credentials does is that after the user has successfully
authenticated, SSSD takes his credentials, hashes them and stores the
hash in the cache. Then, if the server is not available, it's possible
to compare the provided credentials with the hash and log in the user in
offline mode.

[Michael Ströder]

Jakub Hrozek wrote:
>  On Mon, Sep 21, 2015 at 06:09:08PM +0200, mathias dufresne wrote:
> > Does "cache-credentials" option need a LDAPS connection or can we set it
> up
> > over LDAP too?
>  
>  SSSD is built so that authentication never happens
>  over unencrypted channel -- it's either TLS or LDAPs. 
And that's a good thing!

We have 2015: Since several years nobody should send passwords over clear-text
connections anymore.

Ciao, Michael.