On (30/05/16 17:07), Sumit Bose wrote:
Hi,
this patch is the SSSD part of the Authentication Indicator related
changes in FreeIPA. The basic part is that now it is possible to
authenticate at will with either password or 2FA as described on
https://fedorahosted.org/sssd/wiki/DesignDocs/PromptingForMultipleAuthent....
To test you need a FreeIPA server build from the FreeIPA master branch
and optionally Nathaniel's '[PATCH 0093] Enable service authentication
indicator management' which is currently under review for the kvno
related test. Additionally you need MIT Kerberos packages which contain
the fix for
https://bugzilla.redhat.com//show_bug.cgi?id=1340304.
Since this patch changes how libkrb5 gets the password for password
authentication with newer version of MIT Kerberos it would be nice if
someone can run some regression tests with the AD or plain KRB5
auth_provider.
I can see failures in password change for AD provider.
I haven't tried KRB5 or IPA yet.
From 31f0e621fa63764f9f89f8d6e01f94c49675216f Mon Sep 17 00:00:00
2001
From: Sumit Bose <sbose(a)redhat.com>
Date: Thu, 26 May 2016 13:20:59 +0200
Subject: [PATCH] PAM/KRB5: optional otp and password prompting
Depending on the available Kerberos pre-authentication methods pam_sss
will prompt the user for a password, 2 authentication factors or both.
Resolves
https://fedorahosted.org/sssd/ticket/2988
---
src/providers/krb5/krb5_child.c | 76 +++++++++++++++++++++++++++++++++++++++--
src/sss_client/pam_message.h | 2 ++
src/sss_client/pam_sss.c | 15 ++++++--
src/sss_client/sss_cli.h | 5 +++
4 files changed, 93 insertions(+), 5 deletions(-)
//snip
static krb5_error_code sss_krb5_prompter(krb5_context context, void
*data,
const char *name, const char *banner,
int num_prompts, krb5_prompt prompts[])
{
int ret;
+ size_t c;
struct krb5_req *kr = talloc_get_type(data, struct krb5_req);
+ DEBUG(SSSDBG_TRACE_ALL,
+ "sss_krb5_prompter name [%s] banner [%s] num_prompts [%d]
EINVAL.\n",
+ name, banner, num_prompts);
+
if (num_prompts != 0) {
DEBUG(SSSDBG_CRIT_FAILURE, "Cannot handle password prompts.\n");
+ if (DEBUG_IS_SET(SSSDBG_TRACE_ALL)) {
+ for (c = 0; c < num_prompts; c++) {
+ DEBUG(SSSDBG_TRACE_ALL, "Prompt [%u][%s].\n", c,
^^^
type of "c" is size_t an therefore
there should be "%zu". otherwise
there is a warning on 64 bit platforms
CC src/providers/krb5/krb5_child-krb5_child.o
../sssd/src/providers/krb5/krb5_child.c: In function ‘sss_krb5_prompter’:
../sssd/src/providers/krb5/krb5_child.c:665:17: error: format ‘%u’ expects argument of
type ‘unsigned int’, but argument 6 has type ‘size_t {aka long unsigned int}’
[-Werror=format=]
DEBUG(SSSDBG_TRACE_ALL, "Prompt [%u][%s].\n", c,
^~~~~
cc1: all warnings being treated as errors
LS