Authentication on Smart mirroring

[Hyung-Joon Kim]

According to the documentation, it seems like the mirror automatically delegates authentication to the primary. What would happen if the primary goes down for some reason and can't be reached?

We're considering setting up a mirror for our repos to improve its availability for building/deployment. However, smart mirroring wouldn't be a right solution if the mirror is not usable when authentication fails in the primary.

[Michael Heemskerk · Accepted solution]

Smart mirrors delegate authentication and authorisation to the primary, but also maintain a 'credentials cache' and a 'permissions cache'. Side note: this cache does not contain your passwords or SSH keys. Instead it stores a cryptographic hash of your password, which can be used to validate provided credentials.

When the primary is (temporarily) unavailable, the mirror will fall back to authenticating locally using it's credentials cache. Users that have accesses a repository from the mirror will have their credentials and permissions cached and be able to access that repository from the mirror even if the primary is unavailable.

The authentication and permission caches are cleared on restart.

Hope that clears things up a bit!