Hi!
FAST auth is broken for OTP case at least for FreeIPA because krb5_child
returns an empty SSS_OTP message as the last one in the buffer. This message
never got processed by the krb5_child_handler due to the fact that message
size (8 bytes) was triggering the check for buffer length and prematurely
claiming that the whole buffer is malformed.
Fixes
https://fedorahosted.org/sssd/ticket/2186 and now I have working ssh logons
with two-factor authentication using native FreeIPA OTP implementation and FreeOTP Android
app.
Additionally this patch makes clear how ccache name is passed. It avoids looking into
anything
but SSS_PAM_ENV_ITEM message.
--
/ Alexander Bokovoy