and now with patch ...
On Mon, Jun 13, 2016 at 02:00:37PM +0200, Sumit Bose wrote:
> On Fri, Jun 10, 2016 at 02:28:16PM +0200, Lukas Slebodnik wrote:
> > On (30/05/16 17:07), Sumit Bose wrote:
> > >Hi,
> > >
> > >this patch is the SSSD part of the Authentication Indicator related
> > >changes in FreeIPA. The basic part is that now it is possible to
> > >authenticate at will with either password or 2FA as described on
> >
>https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthenticationTypes.
> > >
> > >To test you need a FreeIPA server build from the FreeIPA master branch
> > >and optionally Nathaniel's '[PATCH 0093] Enable service
authentication
> > >indicator management' which is currently under review for the kvno
> > >related test. Additionally you need MIT Kerberos packages which contain
> > >the fix for
https://bugzilla.redhat.com//show_bug.cgi?id=1340304.
> > >
> > >Since this patch changes how libkrb5 gets the password for password
> > >authentication with newer version of MIT Kerberos it would be nice if
> > >someone can run some regression tests with the AD or plain KRB5
> > >auth_provider.
> > >
> > I can see failures in password change for AD provider.
> > I haven't tried KRB5 or IPA yet.
> >
>
> Thank you for testing and reviewing. I guess it was a general issue, the
> new patch should fix it.
>
> >
> ...
> > >+ DEBUG(SSSDBG_TRACE_ALL, "Prompt [%u][%s].\n", c,
> > ^^^
> > type of "c" is size_t an
therefore
> > there should be "%zu".
otherwise
> > there is a warning on 64 bit platforms
> > CC src/providers/krb5/krb5_child-krb5_child.o
> > ../sssd/src/providers/krb5/krb5_child.c: In function ‘sss_krb5_prompter’:
> > ../sssd/src/providers/krb5/krb5_child.c:665:17: error: format ‘%u’ expects
argument of type ‘unsigned int’, but argument 6 has type ‘size_t {aka long unsigned int}’
[-Werror=format=]
> > DEBUG(SSSDBG_TRACE_ALL, "Prompt [%u][%s].\n", c,
> > ^~~~~
> > cc1: all warnings being treated as errors
>
> Fixed as well. New version attached.
>
> bye,
> Sumit
From 28b5cd4eb73cee9401eefd7d0232c5dc69e69f8c Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Thu, 26 May 2016 13:20:59 +0200
Subject: [PATCH] PAM/KRB5: optional otp and password prompting
Depending on the available Kerberos pre-authentication methods pam_sss
will prompt the user for a password, 2 authentication factors or both.
Resolves
https://fedorahosted.org/sssd/ticket/2988
---
Bug with password change is fixed
There aren't any newly introduced isues reported by static analyzers.
All AD tests passed.
I didn't try OTP becuase I do not have such setup
and I need to work on other thing.
If someone could help I will appreciate it.
LS