diff options
| author | Sumit Bose <sbose@redhat.com> | 2015-07-23 15:56:44 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2015-08-04 14:40:43 +0200 |
| commit | 8ffbe4698421aaafa59f0813232883c4fc41514d (patch) | |
| tree | f777b2f1b86d83e1a8c328db2136dcb754bb33c8 | |
| parent | daf44387652fe46a2c8e694720f6b14436a6f31f (diff) | |
| download | sssd-8ffbe4698421aaafa59f0813232883c4fc41514d.tar.gz sssd-8ffbe4698421aaafa59f0813232883c4fc41514d.tar.xz sssd-8ffbe4698421aaafa59f0813232883c4fc41514d.zip | |
krb5: do not send SSS_OTP if two factors were used
Resolves https://fedorahosted.org/sssd/ticket/2729
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
| -rw-r--r-- | src/providers/krb5/krb5_auth.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 8886456c0..d1bf4025b 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -1091,7 +1091,12 @@ static void krb5_auth_done(struct tevent_req *subreq) krb5_auth_store_creds(state->domain, pd); } - if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE) { + /* The SSS_OTP message will prevent pam_sss from putting the entered + * password on the PAM stack for other modules to use. This is not needed + * when both factors were entered separately because here the first factor + * (long term password) can be passed to the other modules. */ + if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE + && sss_authtok_get_type(pd->authtok) != SSS_AUTHTOK_TYPE_2FA) { uint32_t otp_flag = 1; ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t), (const uint8_t *) &otp_flag); |