URL:
https://github.com/SSSD/sssd/pull/760
Title: #760: Add use_2fa_combined option to allow pam services to be configured as
password+otp entry
driskell commented:
"""
Thanks @sumit-bose
I did actually test this patch and unfortunately it fell short of what I needed. Although
it did start allowing me to authenticate with 2FA I had no control over its requirement
except to enable it globally for the user. This led me down a route of exploring
authentication indicators against services but I could not find a way to get PAM to use
one of the service identities. The only way I could do it was via direct Kerberos instead
of PAM, or trying to use pam_krb5. But I think the RHEL pam_krb5 is too old and without
anon_fast it won't work with 2FA.
Your current design looks great (though I do have some limited understanding of the area
still!) - but I guess based on the above won't help too much in my instance. Unless
there would be a way to configure SSSD to use a service principle when authenticating so
indicators can be applied at service level? I'm not sure if that would be a separate
future feature though.
Thanks again.
"""
See the full comment at
https://github.com/SSSD/sssd/pull/760#issuecomment-466414914