this series of patches tries to add special prompting in the PAM dialog
for 2-Factor-Authentication (2FA) and use it where suitable. As
long-term password and one-time component are entered in a single prompt
SSSD is in general not able to split them and use the long-term password
of offline authentication or some user keyrings. With this patch-set an
IPA user with configured OTP token will be prompted to enter the two
factors separately (if the login application supports it) and the first
factor (long-term password) will be save into the cache for offline
authentication if it is long enough.
Two new internals are needed for this. A special authentication token
type for 2FA and a PAM pre-auth request to check if the given user user
a standard password or 2FA/OTP.
The first two patches enhance the authtok module to handle 2FA.
Patches 4-6 add the pre-auth request to PAM client, responder and IPA
backend. Patches 7-12 add the prompting, the minimal length check and
the caching of the first factor. Finally tests for the PAM responder are
added which should test existing and new behaviour.
those two patches should fix https://fedorahosted.org/sssd/ticket/2642 .
The first patch fixes another issue as well which I found during testing
which is described in the commit message. The second patch is the UUID
version of 'IPA: allow initgroups by SID for AD users' sent recently. I
took the opportunity to make the handling in sdap_get_initgr_send() a
bit more clean.
while analyzing the test case described in
https://fedorahosted.org/sssd/ticket/2633 I found some issues both in
the client and server code which are hopefully fixed by the attached
Initially, I wanted to reuse some part of code for
discovery of donain SID and flatname. But it is highly coupled with subdomain
code. So I decided to use simpler way.
Simple patch is attached.