Skip to content

Commit

Permalink
pam: fix storing auth types for offline auth
Browse files Browse the repository at this point in the history
Before the recent patches which allow krb5_child to iterate over all
available authentication methods typically only one method was returned.
E.g. is Smartcard authentication (pkinit) was possible it was typically
the first method the in question list and the result of the
answer_pkinit() function was immediately returned. As a result only the
Smartcard authentication type was set and a missing password
authentication type while others were present might have been a
reasonable indicator for the online state.

With the recent patches, all available methods, including password
authentication if available, are return and a new indicator is needed.

Reviewed-by: Alejandro López <[email protected]>
Reviewed-by: Iker Pedrosa <[email protected]>
Reviewed-by: Justin Stephenson <[email protected]>
Reviewed-by: Scott Poore <[email protected]>
(cherry picked from commit 05df816)
  • Loading branch information
sumit-bose authored and alexey-tikhonov committed Apr 2, 2024
1 parent 829e868 commit b6eae6f
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
1 change: 1 addition & 0 deletions src/responder/pam/pamsrv.h
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@ struct pam_resp_auth_type {
bool otp_auth;
bool cert_auth;
bool passkey_auth;
bool backend_returned_no_auth_type;
};

struct sss_cmd_table *get_pam_cmds(void);
Expand Down
3 changes: 2 additions & 1 deletion src/responder/pam/pamsrv_cmd.c
Original file line number Diff line number Diff line change
Expand Up @@ -915,6 +915,7 @@ errno_t pam_get_auth_types(struct pam_data *pd,
/* If the backend cannot determine which authentication types are
* available the default would be to prompt for a password. */
types.password_auth = true;
types.backend_returned_no_auth_type = true;
}

DEBUG(SSSDBG_TRACE_ALL, "Authentication types for user [%s] and service "
Expand Down Expand Up @@ -1002,7 +1003,7 @@ static errno_t pam_eval_local_auth_policy(TALLOC_CTX *mem_ctx,
}

/* Store the local auth types, in case we go offline */
if (!auth_types.password_auth) {
if (!auth_types.backend_returned_no_auth_type) {
ret = set_local_auth_type(preq, sc_allow, passkey_allow);
if (ret != EOK) {
DEBUG(SSSDBG_FATAL_FAILURE,
Expand Down

0 comments on commit b6eae6f

Please sign in to comment.