Bug 1466505 - 2FA with single prompt should be allowed for a user configurable set of services
2FA with single prompt should be allowed for a user configurable set of services
Status: CLOSED DUPLICATE of bug 1466504
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sssd (Show other bugs)
7.3
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: SSSD Maintainers
sssd-qe
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2017-06-29 16:21 EDT by Jakub Hrozek
Modified: 2017-06-29 16:33 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-06-29 16:33:14 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Jakub Hrozek 2017-06-29 16:21:14 EDT
This bug is created as a clone of upstream ticket:
https://pagure.io/SSSD/sssd/issue/3438

See

       if (resp[1].resp == NULL || *(resp[1].resp) == '\0'
                 || (pi->pam_service != NULL && strcmp(pi->pam_service, "sshd") == 0
                       && strcmp(resp[0].resp, resp[1].resp) == 0)) {
            /* Missing second factor, assume first factor contains combined 2FA
             * credentials.
             * Special handling for SSH with password authentication. Combined
             * 2FA credentials are used but SSH puts them in both responses. */

in

https://github.com/SSSD/sssd/blob/818d01b4a0d332fff06db33c0c985b8c0f1417c7/src/sss_client/pam_sss.c

This code allows only SSHD to combine two factors together but other services might be doing that too. 

User story:
From my application that uses PAM for authentication (WebApp/Radius/Tacacs) I would like to use SSSD for 2FA authentication against IdM. I would like to combine both factors in one prompt for the service I use so that I do not have to implement double prompting in my application.

Proposed approach:
1. SSSD config
single_prompt = sshd, my_app, another_app
2. Pseudo code

        if (resp[1].resp == NULL || *(resp[1].resp) == '\0'
                   || (pi->pam_service != NULL && in_single_prompt_list(pi->pam_service, single_prompt_list) == 0
                          && strcmp(resp[0].resp, resp[1].resp) == 0)) {
       ...
Comment 2 Jakub Hrozek 2017-06-29 16:33:14 EDT

*** This bug has been marked as a duplicate of bug 1466504 ***

Note You need to log in before you can comment on or make changes to this bug.