On Mon, Apr 06, 2015 at 08:58:16PM +0200, Sumit Bose wrote:
Hi,
this series of patches tries to add special prompting in the PAM dialog for 2-Factor-Authentication (2FA) and use it where suitable. As discussed on https://fedorahosted.org/sssd/wiki/DesignDocs/PAMConversationForOTP if long-term password and one-time component are entered in a single prompt SSSD is in general not able to split them and use the long-term password of offline authentication or some user keyrings. With this patch-set an IPA user with configured OTP token will be prompted to enter the two factors separately (if the login application supports it) and the first factor (long-term password) will be save into the cache for offline authentication if it is long enough.
Two new internals are needed for this. A special authentication token type for 2FA and a PAM pre-auth request to check if the given user user a standard password or 2FA/OTP.
The first two patches enhance the authtok module to handle 2FA. Patches 4-6 add the pre-auth request to PAM client, responder and IPA backend. Patches 7-12 add the prompting, the minimal length check and the caching of the first factor. Finally tests for the PAM responder are added which should test existing and new behaviour.
Please find attached a new version of the patch set which contains a few fixes which should silence a couple of compiler warnings.
bye, Sumit