Re: [PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose
On Wed, Jul 06, 2016 at 10:03:12AM -0400, Nathaniel McCallum wrote:
> On Wed, 2016-07-06 at 15:55 +0200, Sumit Bose wrote:
> > On Wed, Jul 06, 2016 at 09:03:45AM -0400, Nathaniel McCallum wrote:
> > >
> > > Patch WFM and looks clean. My only question is on the overall
> >
> > Thank you very much for testing.
> >
> > >
> > > prompting.
> > >
> > > Currently we have:
> > > * 1FA:
> > > - "Password"
> > > * 2FA (required):
> > > - "First Factor"
> > > - "Second Factor"
> > > * 2FA (optional):
> > > - "First Factor or Password"
> > > - "Second Factor, press return for Password authentication"
> > >
> > > This all seems a little verbose to me. It also seems like it
> > > reveals
> > > technical details that don't matter and/or might confuse the user.
> > >
> > > Is there a reason not to do the following?
> > >
> > > * 1FA:
> > > - "Password"
> > > * 2FA (required):
> > > - "Password"
> > > - "Token
> > > Code"
> > > * 2FA (optional):
> > > - "Password"
> > > - "Token Code (optional)"
> > >
> > > This seems to me simpler, shorter and more descriptive.
> > > Alternatively:
> > >
> > > * 1FA:
> > > - "Password"
> > > * 2FA (required):
> > > - "Password"
> > > -
> > > "Second Factor"
> > > * 2FA (optional):
> > > - "Password"
> > > - "Second Factor
> > > (optional)"
> > >
> > > Whatever we decide to do, this patch has my ACK. So feel free to
> > > just
> > > change the string and merge it.
> >
> > When the 2FA prompting was added in the previous release I think I
> > asked
> > for alternative suggestions as well. My main reasons, especially with
> > the 'First Factor' prompt were first to make the user aware that
> > something new is happen. New in the sense that the user should be
> > prepared to enter the second factor in a new prompt and not put the
> > combined password in the 'Password' prompt as he was used to before.
> >
> > And second I wasn't sure if users are aware that the first factor is
> > typically their long term password. Iirc the first factor with RSA
> > tokens are typically referred to as PIN and asking for a password
> > might
> > confuse the users.
> >
> > Maybe we should reach out to UX designers to see what they recommend?
>
> Let's just go with this:
>
> * 1FA:
> - "Password"
> * 2FA:
> - "First Factor"
> - "Second Factor"
> * 2FA, optional:
> - "First Factor"
> - "Second Factor (optional)"
>
> We already implement the first two cases, so adding one word is just a
> small change.
New version attached with the prompts changed accordingly.
bye,
Sumit
7 years, 8 months
fully qualified sysdb names for users and groups
by Jakub Hrozek
Hi,
here is my branch that implements using the fully qualified names in sysdb
for users and groups:
https://github.com/jhrozek/sssd/commits/sysdb-fqdn
The SSSD code changes are done. There are some downstream tests that are
failing (some sudo and some HBAC tests), but I think I can chase those
down quickly.
But -- I still don't have the upgrade code written and I only tested the
IPA overrides and IPA-AD trust code manually, so there might be a lot of
bugs there. It is also a lot of stuff to review.
With that in mind, I would like to ask other developers for opinions --
should we still pursue pushing this refactoring into 1.14? Or should we
release 1.14.0 first and push this patchset as the first thing into
1.15?
I'm really on the fence myself.
7 years, 8 months
[PATCHES] krb5 config snippets
by Sumit Bose
Hi,
the following 4 patches include fixes for
ttps://fedorahosted.org/sssd/ticket/2788 and
https://fedorahosted.org/sssd/ticket/3041. They are not related but
depend on each other patch-wise, so I put them in a single mail. Please
let me know if you prefer to review them separately then I can them in
to different threads.
The first patch just removes the 'enable_only = sssd' like which
effectively disables the default localauth mechanisms like checking
.k5login. I thought we already did this some time ago but apparently not.
While I was at it I made SSSD's localauth plugin non-authoritative for
SSSD users as well (it already is non-authoritative for non-SSSD users,
i.e. it returns KRB5_PLUGIN_NO_HANDLE which leaves the final decision to
a different module). This would allow the usage of .k5login files for
SSSD users as well.
The third and fourth patch create a new krb5 config snippet
krb5_libdefaults which will set 'canonicalize = true' if the related
SSSD option is true as well, which is currently by default the case for
the IPA provider.
bye,
Sumit
7 years, 8 months
[PATCH] LDAP: Change the default rfc2307 autofs attribute mappings
by Jakub Hrozek
Hi,
our rfc2307 attribute mappings are wrongs. Because we are close to
releasing a major release, I think this is the time to change them.
Attached is a patch that changes the attributes and warns users who use
any of the changed attributes in default mappings. If we decide to
accept this patch, we should also file a ticket to remove the warnings
in the next release to avoid warning forever.
7 years, 8 months
[PATCH] PAM/KRB5: optional otp and password prompting
by Sumit Bose
Hi,
this patch is the SSSD part of the Authentication Indicator related
changes in FreeIPA. The basic part is that now it is possible to
authenticate at will with either password or 2FA as described on
https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthent....
To test you need a FreeIPA server build from the FreeIPA master branch
and optionally Nathaniel's '[PATCH 0093] Enable service authentication
indicator management' which is currently under review for the kvno
related test. Additionally you need MIT Kerberos packages which contain
the fix for https://bugzilla.redhat.com//show_bug.cgi?id=1340304.
Since this patch changes how libkrb5 gets the password for password
authentication with newer version of MIT Kerberos it would be nice if
someone can run some regression tests with the AD or plain KRB5
auth_provider.
bye,
Sumit
7 years, 8 months