krb5: fix OTP authentication #8296
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes an issue with OTP authentication in the Kerberos provider. The change correctly sets the kr->otp flag in the request_otp function, which is called during pre-authentication when OTP is available. This fix is necessary to ensure the user is prompted for OTP. The logic is now consistent with the corresponding answer_otp function. The change is simple, targeted, and I find it to be correct.
|
JFTR: instructions how to run FreeIPA tests for this patch. |
PR to run FreeIPA tests: freeipa/freeipa#8055 |
|
Added an additional commit to fix a related issue |
alexey-tikhonov
requested review from
justin-stephenson
and removed request for
ikerexxe
sumit-bose
force-pushed
the
krb5_fix_otp
branch
from
85725c6 to
e174ba4
Compare
|
Covscan is green. |
Resolves: SSSD#8292 Reviewed-by: Justin Stephenson <jstephen@redhat.com>
The `tokeninfo_matches()` function already handles PAM stacked tokens correctly by processing them through the 2FA single path, so the `answer_otp()` function should allow this token type to proceed. Add SSS_AUTHTOK_TYPE_PAM_STACKED to the allowed authentication token types in `answer_otp()` to restore previous functionality. Fixes: 4cb99a2 ("krb5_child: advertise authentication methods"). Signed-off-by: Iker Pedrosa <ipedrosa@redhat.com> Reviewed-by: Justin Stephenson <jstephen@redhat.com>
sssd-bot
force-pushed
the
krb5_fix_otp
branch
from
e174ba4 to
11fcc28
Compare
|
@ikerexxe @sumit-bose This will need manual backport to sssd-2-9 after passworldess GDM patches are merged there, yes? |
Imo, it can be included in open PR directly. |
5 participants
Resolves: #8292