URL: https://github.com/freeipa/freeipa/pull/516
Title: #516: IdM Server: list all Employees with matching Smart Card

dkupka commented:
@flo-renaud While playing with this command I've noticed one disturbing fact. 
Because we rely on SSSD and SSSD rely its cache we will likely return 
inaccurate result.
I'm thinking about use-case when admin calls certmap-match to list current 
users mapped to the certificate. Then he performs some changes and  calls 
certmap-match again to verify his changes. At that point SSSD may use cache and 
return obsolete result.
One possible solution would be expiring the cache on every certmap-match call 
but that can easily have serious performance impact.

See the full comment at 
Manage your subscription for the Freeipa-devel mailing list:
Contribute to FreeIPA: http://www.freeipa.org/page/Contribute/Code

Reply via email to