Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Make PAM auth TTL customisable #494

Copy link
Copy link

Description

@sellth
Issue body actions

As I understand the current implementation, time-to-live for PAM auth tokens is hardcoded to 60. As we require longer lasting sessions for our use cases, it would be great if users could set TTL to a custom value within the constraints of the server's pam_password_max_time setting. The iinit command already implements this via the --ttl flag (https://docs.irods.org/4.3.1/icommands/user/#iinit).

For reference:

def _login_pam(self):
time_to_live_in_seconds = 60
pam_password = PAM_PW_ESC_PATTERN.sub(lambda m: '\\'+m.group(1), self.account.password)
ctx_user = '%s=%s' % (AUTH_USER_KEY, self.account.client_user)
ctx_pwd = '%s=%s' % (AUTH_PWD_KEY, pam_password)
ctx_ttl = '%s=%s' % (AUTH_TTL_KEY, str(time_to_live_in_seconds))
ctx = ";".join([ctx_user, ctx_pwd, ctx_ttl])

On a side note, I'm pretty sure that the default value of 60 is actually in hours and not seconds. So the variable is named wrongly in the code snippet above.

Reference of the server-side code: https://github.com/irods/irods/blob/aff93a3fbe417c8ec2e9d834b5eb2d6b2ae31083/lib/core/src/clientLogin.cpp#L237-L239

Reactions are currently unavailable

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.