<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> On 12/05/2011 09:33 AM, Stephen Gallagher wrote: <blockquote cite="mid:1323095632.2194.41.camel@sgallagh520.sgallagh.bos.redhat.com" type="cite"> <pre wrap="">On Sat, 2011-12-03 at 14:06 -0500, Dmitri Pal wrote: </pre> <blockquote type="cite"> <pre wrap="">On 12/01/2011 08:48 PM, Simo Sorce wrote: </pre> <blockquote type="cite"> <pre wrap="">On Thu, 2011-12-01 at 19:31 -0500, John Dennis wrote: </pre> <blockquote type="cite"> <pre wrap="">On 12/01/2011 06:54 PM, Dmitri Pal wrote: </pre> <blockquote type="cite"> <pre wrap="">Seems reasonable. I agree with pros and cons and suggestions but I am not the person to make the final approval. Simo? Question for John: Is there any benefit for CLI or it is for UI only? </pre> </blockquote> <pre wrap="">Currently it would benefit the UI only. That's mostly because there is no mechanism in the cli to cache the session ID. Adding that wouldn't be too difficult except for the issue of how to store the session ID securely, it would have to be written to a file (unlike with a browser which is supposed to hold session cookies in memory). Is there an ability to add a data item like this to the user's kerberos credential cache? </pre> </blockquote> <pre wrap="">Yes we could create a fake key and stick the session id in it. That was the trick we proposed using when this question was raised a few months ago during a conference call on the matter. Simo. </pre> </blockquote> <pre wrap="">Can we please then extend the design to include this? </pre> </blockquote> <pre wrap=""> Another approach (on Linux only) would be to have the CLI stuff the session key into the kernel keyring. It would be secure and would be capable of outliving the TGT life (if the session expiration is longer than the TGT expiration). </pre> </blockquote> We support CLI only on Linux so this is not an issue. But it would not work cross multiple CLI commands as they are different processes and AFAIU only the process that put the data into the keyring would be able to fetch it unless we provide a special IPA shell that keeps one process and executes batch inside it. Am I wrong? <blockquote cite="mid:1323095632.2194.41.camel@sgallagh520.sgallagh.bos.redhat.com" type="cite"> <pre wrap=""> <fieldset class="mimeAttachmentHeader"></fieldset> _______________________________________________ Freeipa-devel mailing list <a class="moz-txt-link-abbreviated" href="mailto:Freeipa-devel@redhat.com">Freeipa-devel@redhat.com</a> <a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-devel">https://www.redhat.com/mailman/listinfo/freeipa-devel</a></pre> </blockquote> <pre class="moz-signature" cols="72">-- Thank you, Dmitri Pal Sr. Engineering Manager IPA project, Red Hat Inc. ------------------------------- Looking to carve out IT costs? <a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a> </pre> </body> </html>