[SSSD] [PATCH] Skip CHAUTHTOK_PRELIM when using OTPs

Jakub Hrozek jhrozek at redhat.com
Tue Dec 2 09:46:15 UTC 2014


On Tue, Dec 02, 2014 at 10:22:38AM +0100, Jakub Hrozek wrote:
> I agree it would be ideal to keep around the creds for "kadmin/changepw"
> somehow to avoid calling the same code twice, but currently that's not
> possible, the krb5_child code is one-shot. In the next release, we could
> either change the code to keep the child around, or maybe transfer the
> "kadmin/changepw" credentials back to the caller in some encoding..but
> I'm afraid that's out of scope for 7.1

Alternatively, we could reverse the logic and display the nice error
messages w/o touching the state if acquiring the changepw principal
failed.



More information about the sssd-devel mailing list