URL:
https://github.com/SSSD/sssd/pull/268
Author: sumit-bose
Title: #268: pam_sss: add support for SSS_PAM_CERT_INFO_WITH_HINT
Action: opened
PR body:
"""
This patchset got lost when I prepared the certificate mapping patch set.
Applications like gdm with enabled Smartcard support will try to determine the
user based on data from the certificate or expected that it is done for them
and hence do not prompt for a user name. If a certificate is mapped to multiple
accounts this cannot work because it is not clear which account should be used.
In this case a 'user name hint' must be given by the user to help the
application to find the right user.
To get a consistent user experience while still only prompt for a PIN in
environments where a certificate is uniquely mapped to only a single user IPA
offers the 'ipa certmapconfig-mod --promptusername=BOOL' command to switch
'user name hinting' on or off.
To test the behavior 'sssctl user-checks' can be used.
/etc/pam.d/smartcart-auth should be configured for SSSD and like:
...
auth required pam_env.so
auth sufficient pam_sss.so allow_missing_name
auth required pam_deny.so
...
If now a Smartcard in inserted where the certificate is mapped to multiple
users you will see:
user:
action: auth
service: gdm-smartcard
testing pam_authenticate
PIN for AD.DEVEL Admin (OpenSC Card)
User name hint:
pam_authenticate for user []: Authentication failure
PAM Environment:
- PKCS11_LOGIN_TOKEN_NAME=AD.DEVEL Admin (OpenSC Card)
if no user name hint is given and
user:
action: auth
service: gdm-smartcard
testing pam_authenticate
PIN for AD.DEVEL Admin (OpenSC Card)
User name hint: scuser
pam_authenticate for user [scuser]: Success
PAM Environment:
- PKCS11_LOGIN_TOKEN_NAME=AD.DEVEL Admin (OpenSC Card)
if a suitable user name hint was given.
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/268/head:pr268
git checkout pr268