On Fri, Sep 11, 2020 at 07:30:53PM +0200, Radoslaw Kujawa via FreeIPA-users wrote:
On 9/10/20 6:48 PM, Radoslaw Kujawa via FreeIPA-users wrote:
>
>I will coordinate with Jan to check if it is the same problem on his
>Ubuntu.
>
Indeed, all of these problems boil down to a missing krb5-pkinit package.
I was confused, because even though krb5-pkinit was missing, the Smart
Card authentication _was_ working (when OTP was disabled). So it
didn't occur to me that could be the cause.
Hi,
if OTP is not available and a Smartcard is available SSSD prefers the
Smartcard or password authentication (everything is better than a
password) and switches to local/offline Smartcard authentication. In
this case you won't get a Kerbers TGT but you will be authenticated
based on the inserted Smartcard and your knowledge of the PIN. This is
the same scheme used if the system is offline.
About adding a warning that krb5-pkinit is missing, that would be
possible. But since there are valid use-cases where the pkinit module is
missing, e.g. the server side does not support pkinit, I think this
message would be only shown in the SSSD logs with a certain debug_level.
Do you think this would help?
bye,
Sumit
Best regards,
Radoslaw
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...