Hi,
this series of patches tries to add special prompting in the PAM dialog
for 2-Factor-Authentication (2FA) and use it where suitable. As
discussed on
https://fedorahosted.org/sssd/wiki/DesignDocs/PAMConversationForOTP if
long-term password and one-time component are entered in a single prompt
SSSD is in general not able to split them and use the long-term password
of offline authentication or some user keyrings. With this patch-set an
IPA user with configured OTP token will be prompted to enter the two
factors separately (if the login application supports it) and the first
factor (long-term password) will be save into the cache for offline
authentication if it is long enough.
Two new internals are needed for this. A special authentication token
type for 2FA and a PAM pre-auth request to check if the given user user
a standard password or 2FA/OTP.
The first two patches enhance the authtok module to handle 2FA.
Patches 4-6 add the pre-auth request to PAM client, responder and IPA
backend. Patches 7-12 add the prompting, the minimal length check and
the caching of the first factor. Finally tests for the PAM responder are
added which should test existing and new behaviour.
bye,
Sumit