On Tue, Dec 24, 2013 at 06:34:24AM -0500, Alexander Bokovoy wrote:
FAST auth is broken for OTP case at least for FreeIPA because krb5_child
returns an empty SSS_OTP message as the last one in the buffer. This message
never got processed by the krb5_child_handler due to the fact that message
size (8 bytes) was triggering the check for buffer length and prematurely
claiming that the whole buffer is malformed.
and now I have working ssh logons
with two-factor authentication using native FreeIPA OTP implementation and FreeOTP
Additionally this patch makes clear how ccache name is passed. It avoids looking into
but SSS_PAM_ENV_ITEM message.
/ Alexander Bokovoy
My IPA server's OTP integration is broken at the moment (even outside
SSSD) so I wasn't able to test the OTP support per se, but I trust
However, this patch looks good to me and all the usual krb5_child
operations (auth, chpass) still work fine.