On Fri, Feb 20, 2015 at 07:28:13PM -0500, Dmitri Pal wrote:
>I want to avoid any un-needed communication between the pam_ss
>and the responder. An SSSD option would be a backend specific option and
>pam_sss would have to ask for every auth request the responder first
>(which might ask the backend) which is imo too much overhead for the
>general non-2FA case. Checking for the existence of a file looks like
>the most easy and fastest way to check if the pre-auth request should
>really be run.
Why create a new machanizm. Can we use a pam option instead? It is
definitely available to the PAM stack without any extra fie operations.
I don't think a simple open() or access() is too much overhead.
Additionally, this scheme allows the backend to create the file when the
backend discovers the OTPs might be enabled at all.