[SSSD] [PATCH] krb5: do not send SSS_OTP if two factors were used

Sumit Bose sbose at redhat.com
Thu Jul 23 15:20:17 UTC 2015


Hi,

This patch fixes an issue with two factor authentication. When the user
is prompted to enter long term password (first factor) and one-time
component (second factor) separately the first component may remain on
the PAM stack so that other modules can use the long term password.

bye,
Sumit

-------------- next part --------------
From 0a2709349af49ae77f675fb39418d33e7894d0b7 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Thu, 23 Jul 2015 15:56:44 +0200
Subject: [PATCH] krb5: do not send SSS_OTP if two factors were used

Resolves https://fedorahosted.org/sssd/ticket/2729
---
 src/providers/krb5/krb5_auth.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index c94f2b26f8d4b8d5d3bd5d7836052c478e13aba7..1c55ec3fca15db9ea717e590c5743f8365ec8c0d 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1091,7 +1091,12 @@ static void krb5_auth_done(struct tevent_req *subreq)
         krb5_auth_store_creds(state->domain, pd);
     }
 
-    if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE) {
+    /* The SSS_OTP message will prevent pam_sss from putting the entered
+     * password on the PAM stack for other modules to use. This is not needed
+     * when both factors were entered separately because here the first factor
+     * (long term password) can be passed to the other modules. */
+    if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE
+            && sss_authtok_get_type(pd->authtok) != SSS_AUTHTOK_TYPE_2FA) {
         uint32_t otp_flag = 1;
         ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t),
                                (const uint8_t *) &otp_flag);
-- 
2.1.0



More information about the sssd-devel mailing list