On Wed, Nov 14, 2018 at 10:45:46AM -0000, MOHIT KUMAR wrote:
I have hooked one pam implementation module pam_custom.so which does
multi factor authentication for a user
I am trying to use pam_get_item for otp in my internal pam pam_custom.so module with
msg.style type as PAM_TEXT_INFO.
But it is failing as i am getting error message as Conversation style 3 not supported.
This is breaking my existing functionality and I am not able to use sssd. Is it a
limitation with sssd? Although normal username and password is authenticated successfully
for which MFA is not there.
SSSD's proxy functionality is limited in the sense that it currently
only can give a password the user entered before to the proxied PAM
modules. I.e. currently we can only handle PAM_PROMPT_ECHO_OFF properly
and return an error for other messages styles.
Is the message your are sending with PAM_TEXT_INFO important for the
functionality, e.g. does it contain a challenge which should be typed
into some device to get a one-time response? Or is it just some
informational message? In the latter case, would it be possible to add a
check to your PAM module to not send this message is the PAM service is
'sssdproxycustom' ?
bye,
Sumit
>
> sssd.conf
> --------------------[sssd]
> config_file_version = 2
> services = nss, pam
> domains = proxy_proxy
> [nss]
>
> [pam]
> [domain/proxy_proxy]
> auth_provider = proxy
> id_provider = proxy
> proxy_lib_name = customnss
> proxy_pam_target = sssdproxycustom
> enumerate = false
> cache_credentials = false
> debug_level = 9
> min_id = 500
>
>
> sssdproxycustom
> --------------------------
> auth required pam_custom.so
> account required pam_custom.so
> password required pam_custom.so
> session required pam_custom.so
>
>
> _______________________________________________
> sssd-devel mailing list -- sssd-devel(a)lists.fedorahosted.org
> To unsubscribe send an email to sssd-devel-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
> List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
https://lists.fedorahosted.org/archives/list/sssd-devel@lists.fedorahoste...