URL:
https://github.com/SSSD/sssd/pull/483
Author: sumit-bose
Title: #483: Password change with two factor authentication
Action: opened
PR body:
"""
If two factor authentication is enforced both authentication factors are
needed to update or change the long term password. This means that during
the PAM chauthok operation it has to be determined if two factor
authentication is enable for the user and the user must be prompted
accordingly.
Typically in the first step of the chauthok operation (PAM_PRELIM_CHECK)
the current password is verified before asking the user for a new password.
With two factor authentication this has to be skipped because the one-time
factor would then be invalid to authenticate the actual password change.
In krb5_child if the long term Kerberos password is expired the available
pre-authentication types for the user should be checked by requesting the
kadmin/changepw principal.
Related to
https://pagure.io/SSSD/sssd/issue/3585
"""
To pull the PR as Git branch:
git remote add ghsssd
https://github.com/SSSD/sssd
git fetch ghsssd pull/483/head:pr483
git checkout pr483