As an admin, I want to manage offline credential cache settings

[guimard]

User Story

As an LLNG administrator,
I want to configure offline authentication settings per server group,
So that I can control which servers allow offline access and for how long.

Acceptance Criteria

• New config options in LLNG Manager per server_group
• Enable/disable offline mode per server group
• Maximum cache expiration time
• Response includes offline_allowed flag
• Audit log entries for offline authentications

Technical Details

LLNG Configuration

# PAM Access > Server Groups > Offline Settings
pamOfflineEnabled => {
    'workstations' => 1,
    'production'   => 0,  # No offline on prod servers
    'bastion'      => 0,  # No offline on bastion
}

pamOfflineMaxExpiration => {
    'workstations' => 30,  # days
}

Response Extension

{
  "authorized": true,
  "offline": {
    "allowed": true,
    "max_expiration_days": 30
  }
}

Component

Repo: lemonldap-ng (Perl)
Files:

• Portal/Plugins/PamAccess.pm
• Manager/Build/Attributes.pm