SSSD and credential caching - expiration?

[havenoclu]

Hello all. I am using freeIPA and have set my laptop up as an IPA client. Everything is working great, but I am curious about how credential caching works with sssd in regard to expiration.

If I take my laptop out and about for, say, a few days...how long will I be able to login with my cached credentials? I do have a VPN back home, so I should be able to renew my kerberos ticket but worry that I may be unable to login if I wait too long since now my ability to login is completely dependent upon sssd in the pam stack and my IPA server. TIA

[sgallagh]

Hello all. I am using freeIPA and have set my laptop up as an IPA client. Everything is working great, but I am curious about how credential caching works with sssd in regard to expiration.

If I take my laptop out and about for, say, a few days...how long will I be able to login with my cached credentials? I do have a VPN back home, so I should be able to renew my kerberos ticket but worry that I may be unable to login if I wait too long since now my ability to login is completely dependent upon sssd in the pam stack and my IPA server. TIA

By default, there is no expiration on offline caching. If it makes sense for your deployment, you can choose to set an expiration with the parameter 'offline_credentials_expiration' in the [pam] section of sssd.conf. For more details, see the sssd.conf(5) manpage.

[havenoclu]

Thanks for the information!