On Tue, Oct 21, 2014 at 01:29:53PM -0400, Nathaniel McCallum wrote:
On Tue, 2014-10-21 at 00:44 +0200, Lukas Slebodnik wrote:
> ehlo,
>
> We remove the password from the PAM stack when OTP is used to make sure
> that other pam modules (pam-gnome-keyring, pam_mount) cannot use it anymore
> and have to request a password on their own.
>
> Resolves:
https://fedorahosted.org/sssd/ticket/2287
>
> Simple patch is attached.
I may be wrong, but I think that making the pam_add_response() and
pam_set_item() errors non-fatal is incorrect. Attempting to use the OTP
credentials again could result in further errors, keyring problems or
account locking. It seems to me that it would better to fail the
authentication if you cannot guarantee that OTP credentials will not be
reused.
On the other hand, logging in as the user in question (and then letting
him to sudo) might be the only way of getting access into the system at
all..