[SSSD] [PATCHES] PAM: authenticate agains cache

Jakub Hrozek jhrozek at redhat.com
Mon Jul 6 11:44:36 UTC 2015


On Fri, Jul 03, 2015 at 05:44:27PM +0200, Pavel Reichl wrote:
> On 07/02/2015 03:06 PM, Pavel Reichl wrote:
> >Hello,
> >
> >new round of patches is attached. I discussed the required changes with
> >Jakub to be sure we are on the same page as this thread is quite
> >voluminous.
> >
> >Basically I just made the setters/getters static and removed tests of this
> >functions. I hope that by this change we finally reached the desired level
> >of design quality.
> >
> >Thanks!
> >
> >PS: Feel free to ignore patch 3. It's just a by-product of this effort.
> >
> >
> >_______________________________________________
> >sssd-devel mailing list
> >sssd-devel at lists.fedorahosted.org
> >https://lists.fedorahosted.org/mailman/listinfo/sssd-devel
> Attached patch set fixes minor code style issues.

These patches work for me, but I also tested OTP and it doesn't behave
as we agreed on in this thread:
    https://www.redhat.com/archives/freeipa-users/2015-June/msg00575.html

Currently only the first factor was considered during the cached auth
period, so anything could be input as the second factor. I propose this
patch:
    https://fedorapeople.org/cgit/jhrozek/public_git/sssd.git/commit/?h=review&id=848ccf531afebe54be5d9c120fa90c18b0749cfe

We should also amend the manpage if the code is OK.



More information about the sssd-devel mailing list