krb5: fix OTP authentication#8296
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes an issue with OTP authentication in the Kerberos provider. The change correctly sets the kr->otp flag in the request_otp function, which is called during pre-authentication when OTP is available. This fix is necessary to ensure the user is prompted for OTP. The logic is now consistent with the corresponding answer_otp function. The change is simple, targeted, and I find it to be correct.
|
JFTR: instructions how to run FreeIPA tests for this patch. |
PR to run FreeIPA tests: freeipa/freeipa#8055 |
|
Added an additional commit to fix a related issue |
85725c6 to
e174ba4
Compare
|
Covscan is green. |
Resolves: SSSD#8292 Reviewed-by: Justin Stephenson <[email protected]>
The `tokeninfo_matches()` function already handles PAM stacked tokens correctly by processing them through the 2FA single path, so the `answer_otp()` function should allow this token type to proceed. Add SSS_AUTHTOK_TYPE_PAM_STACKED to the allowed authentication token types in `answer_otp()` to restore previous functionality. Fixes: 4cb99a2 ("krb5_child: advertise authentication methods"). Signed-off-by: Iker Pedrosa <[email protected]> Reviewed-by: Justin Stephenson <[email protected]>
e174ba4 to
11fcc28
Compare
|
@ikerexxe @sumit-bose This will need manual backport to sssd-2-9 after passworldess GDM patches are merged there, yes? |
Imo, it can be included in open PR directly. |
5 participants
Resolves: #8292