[SSSD] [PATCH] Add retry option to pam_sss

Stephen Gallagher sgallagh at redhat.com
Fri May 7 20:08:38 UTC 2010


On 05/07/2010 03:39 PM, Sumit Bose wrote:
> On Thu, May 06, 2010 at 03:05:09PM +0200, Jakub Hrozek wrote:
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> On 05/05/2010 04:13 PM, Jakub Hrozek wrote:
>>> Sumit, can you give me some more information on how to test this?
>>>
>>>  From what I gathered, you should be asked for a password as many times
>>> as the retry= option for pam_sss says. What I'm seeing is that pam_sss
>>> does not ask again..just retries the same password
>>
>> After a debugging session off-list we found out that my issue was not
>> caused by error in the code but rather by the fact I was testing with
>> sshd with PasswordAuthentication - as Sumit pointed out out in this case
>> the user prompt and the pam conversation call is directly handled by
>> sshd. ChallengeResponseAuthentication must be used in order to get the
>> desired behaviour with retry= option.
>>
>> So, nack to the original patch - we need to document the above in the
>> pam_sss man page.
>
> done
>
>>
>> The code looks OK to me, just one nitpick while you are changing the
>> patch - can you fix the indent after the "flags&=
>> !FLAGS_USE_FIRST_PASS;" reset? Also I'm generally afraid of hardcoded
>
> done
>
>> constans like the "6" used in case of handling of the "retry="
>> option..but in this case it is probably, we're unlikely to ever change
>> the option and it is confined to the eval_argv() function.
>
> done
>
> New version attached.
>
> bye,
> Sumit
>

Ack.

-- 
Stephen Gallagher
RHCE 804006346421761

Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/



More information about the sssd-devel mailing list