On pe, 29 marras 2019, Morgan Cox via FreeIPA-users wrote:
In my auth-ldap config I haven't put a password so I assume its
anonymous ?
Will HBAC rules work when using OTP also ? My understanding was that
pam_sss is hardcoded and only works with sshd ?
There is a change:
https://pagure.io/SSSD/sssd/issue/3264. As Sumit said
in
https://pagure.io/SSSD/sssd/issue/3438,
"The "alternative approach" is already available.
If there is no reply to the second prompt (resp[1].resp == NULL ||
*(resp[1].resp) == '\0') then this code path is taken as well.
The special handling of sshd is not about putting password and OTP in a
single value but the behavior of the conversation callback of sshd to
put the single input from the user into every reply.
But there is one thing to keep in mind. pam_sss will send the data to
SSSD flagged as password. If the user is configured for 2FA then the
backend will assume the input is a password and OTP in a single string.
But is the user is configured for both 2FA or 1FA then this input will
only be used for the password (1FA) authentication. There will be no
fallback to 2FA because one of the original principal of SSSD was that
the credentials will be only used once and not tried as long an
authentication methods is successful.
There is a more general ticket
https://pagure.io/SSSD/sssd/issue/3264.
"
It is released in SSSD 2.2.0, so it is part of RHEL 8.1.0.
I haven't seen any release of SSSD 1.16 that includes the fixes yet but
the backport was done upstream to 1.16 branch.
So you might want to try with RHEL 8.1 or Fedora 31.
i.e
https://www.reddit.com/r/linuxadmin/comments/5wjqs6/freeipa_openvpn_otp_t...
> On pe, 29 marras 2019, Morgan Cox via FreeIPA-users wrote:
>
> Are you binding to LDAP for these searches anonymously? The access to
> member attribute is only provided for authenticated connections.
>
>
> Frankly, I would rather use HBAC rules and configured OpenVPN to ask PAM
> to do authorization like we discussed some time ago in
>
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
--
/ Alexander Bokovoy
Sr. Principal Software Engineer
Security / Identity Management Engineering
Red Hat Limited, Finland