Title: #760: Add use_2fa_combined option to allow pam services to be configured as
This is a rough idea and does build successfully but I'm still in the process of
getting some testing arranged - I was pulled away from testing unfortunately but wanted to
put the idea forward for examination in advance.
I had been trying to get a service to use PAM with 2FA within a FreeIPA environment.
However, I was having issues with it refusing to accept a password+otp entry as the single
password entered. Having examined the logs it appeared that the 2FA token was being
rejected as being incorrect. This confused me as SSHD was working fine and seemed to be
configured identically. Looking at the code of the service I could see it was because it
was responding to all PAM prompts with the same entered value - the password+otp
combination - but was receiving two prompts. Checking SSSD I found the issue in that this
behaviour is only allowed for SSHD service, and that the service name was hard-coded in.
This PR adds a new option to pam_sssd, `use_2fa_combined` which allows any service to be
configured to behave like `sshd` does, without breaking any compatibility with existing
Does this look like something that would be an acceptable feature to implement, assuming I
finish testing and the overall idea works 👍
To pull the PR as Git branch:
git remote add ghsssd https://github.com/SSSD/sssd
git fetch ghsssd pull/760/head:pr760
git checkout pr760