On Tue, Dec 24, 2013 at 06:34:24AM -0500, Alexander Bokovoy wrote:
Hi!
FAST auth is broken for OTP case at least for FreeIPA because krb5_child
returns an empty SSS_OTP message as the last one in the buffer. This message
never got processed by the krb5_child_handler due to the fact that message
size (8 bytes) was triggering the check for buffer length and prematurely
claiming that the whole buffer is malformed.
Fixes
https://fedorahosted.org/sssd/ticket/2186 and now I have working ssh logons
with two-factor authentication using native FreeIPA OTP implementation and FreeOTP
Android app.
Additionally this patch makes clear how ccache name is passed. It avoids looking into
anything
but SSS_PAM_ENV_ITEM message.
--
/ Alexander Bokovoy
My IPA server's OTP integration is broken at the moment (even outside
SSSD) so I wasn't able to test the OTP support per se, but I trust
Alexander's testing.
However, this patch looks good to me and all the usual krb5_child
operations (auth, chpass) still work fine.
ACK