URL:
https://github.com/SSSD/sssd/pull/5494
Title: #5494: pam_sss_gss: support authentication indicators
abbra commented:
"""
It now works for me. Here is a test on Fedora 33:
```
[admin@master ~]$ export KRB5CCNAME=/tmp/admin.cc
[admin@master ~]$ sudo -l
pam_sss_gss: Initializing GSSAPI authentication with SSSD
pam_sss_gss: Switching euid from 0 to 1169800000
pam_sss_gss: Trying to establish security context
pam_sss_gss: SSSD User name: admin(a)ipa.test
pam_sss_gss: User domain: ipa.test
pam_sss_gss: User principal:
pam_sss_gss: Target name: host(a)master.ipa.test
pam_sss_gss: Using ccache: /tmp/admin.cc
pam_sss_gss: Acquiring credentials, principal name will be derived
pam_sss_gss: Switching euid from 1169800000 to 0
pam_sss_gss: Authentication successful
Matching Defaults entries for admin on master:
!visiblepw, always_set_home, match_group_by_gid, always_query_group_plugin, env_reset,
env_keep="COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS",
env_keep+="MAIL QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE",
env_keep+="LC_COLLATE LC_IDENTIFICATION
LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY LC_NAME LC_NUMERIC
LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET
XAUTHORITY",
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/var/lib/snapd/snap/bin
User admin may run the following commands on master:
(root) ALL
[admin@master ~]$ logout
[root@master ~]# grep pam_gssapi /etc/sssd/sssd.conf
pam_gssapi_services = sudo, sudo-i
pam_gssapi_indicators_map = hardened, sudo:pkinit, sudo-i:otp
[root@master ~]# fgrep gssapi_ /var/log/sssd/sssd_pam.log |tail -10
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_init_done] (0x0400): Trying GSSAPI auth:
User[admin(a)ipa.test], Domain[ipa.test], UPN[], Target[host(a)master.ipa.test]
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_init_done] (0x0400): Returning [0]: Success
(2021-02-08 17:18:50): [pam] [gssapi_handshake] (0x0400): Security context established
with [admin(a)IPA.TEST]
(2021-02-08 17:18:50): [pam] [gssapi_get_indicators] (0x0400): attribute's
[auth-indicators] value [hardened] authenticated
(2021-02-08 17:18:50): [pam] [gssapi_get_indicators] (0x0400): authentication indicators:
[hardened]
(2021-02-08 17:18:50): [pam] [pam_gssapi_check_indicators] (0x0400): indicator [hardened]
is allowed for PAM service [sudo]
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_sec_ctx] (0x0400): Check if acquired service
ticket has req. indicators: 0
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_sec_ctx] (0x0400): Checking that target user
matches UPN
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_sec_ctx_done] (0x0400): User [admin(a)ipa.test]
match UPN [admin(a)IPA.TEST]. Authentication was successful.
(2021-02-08 17:18:50): [pam] [pam_cmd_gssapi_sec_ctx_done] (0x0400): Returning [0]:
Success
```
"""
See the full comment at
https://github.com/SSSD/sssd/pull/5494#issuecomment-775308547