Passwordless-GDM integration: smartcard and passkey

src/confdb/confdb.h

@@ -329,11 +329,15 @@
 #define CONFDB_PC_TYPE_PASSKEY "passkey"
 #define CONFDB_PC_PASSKEY_INTERACTIVE "interactive"
 #define CONFDB_PC_PASSKEY_INTERACTIVE_PROMPT "interactive_prompt"
+#define CONFDB_PC_PASSKEY_PIN_PROMPT "pin_prompt"
 #define CONFDB_PC_PASSKEY_TOUCH "touch"
 #define CONFDB_PC_PASSKEY_TOUCH_PROMPT "touch_prompt"
 #define CONFDB_PC_TYPE_EIDP "eidp"
 #define CONFDB_PC_EIDP_INIT_PROMPT "init_prompt"
 #define CONFDB_PC_EIDP_LINK_PROMPT "link_prompt"
+#define CONFDB_PC_TYPE_SMARTCARD "smartcard"
+#define CONFDB_PC_SMARTCARD_INIT_PROMPT "init_prompt"
+#define CONFDB_PC_SMARTCARD_PIN_PROMPT "pin_prompt"
 
 struct confdb_ctx;
 

src/config/cfg_rules.ini

@@ -325,6 +325,7 @@ section_re = ^prompting/passkey$
 
 option = interactive
 option = interactive_prompt
+option = pin_prompt
 option = touch
 option = touch_prompt
 
@@ -335,6 +336,13 @@ section_re = ^prompting/eidp$
 option = init_prompt
 option = link_prompt
 
+[rule/allowed_prompting_smartcard_options]
+validator = ini_allowed_options
+section_re = ^prompting/smartcard$
+
+option = init_prompt
+option = pin_prompt
+
 [rule/allowed_prompting_password_subsec_options]
 validator = ini_allowed_options
 section_re = ^prompting/password/[^/\@]\+$

src/man/sssd.conf.5.xml

@@ -4631,6 +4631,13 @@ ldap_user_extra_attrs = phone:telephoneNumber
                             </para>
                         </listitem>
                     </varlistentry>
+                    <varlistentry>
+                        <term>pin_prompt</term>
+                        <listitem>
+                            <para>to change the message of the PIN prompt.
+                            </para>
+                        </listitem>
+                    </varlistentry>
                     <varlistentry>
                         <term>touch</term>
                         <listitem>
@@ -4677,6 +4684,32 @@ ldap_user_extra_attrs = phone:telephoneNumber
                 </listitem>
             </varlistentry>
         </variablelist>
+        <variablelist>
+            <varlistentry>
+                <term>[prompting/smartcard]</term>
+                <listitem>
+                    <para>to configure smartcard authentication prompting,
+                    allowed options are:
+                    <variablelist>
+                    <varlistentry>
+                        <term>init_prompt</term>
+                        <listitem>
+                            <para>to change the message of the initial prompt.
+                            </para>
+                        </listitem>
+                    </varlistentry>
+                    <varlistentry>
+                        <term>pin_prompt</term>
+                        <listitem>
+                            <para>to change the message of the PIN prompt.
+                            </para>
+                        </listitem>
+                    </varlistentry>
+                    </variablelist>
+                    </para>
+                </listitem>
+            </varlistentry>
+        </variablelist>
         </para>
         <para>
             It is possible to add a subsection for specific PAM services,

src/responder/pam/pam_prompting_config.c

@@ -26,9 +26,12 @@
 #include "responder/pam/pamsrv.h"
 
 #define DEFAULT_PASSKEY_PROMPT_INTERACTIVE _("Insert your Passkey device, then press ENTER.")
+#define DEFAULT_PASSKEY_PROMPT_PIN _("Security key PIN")
 #define DEFAULT_PASSKEY_PROMPT_TOUCH _("Please touch the device.")
 #define DEFAULT_EIDP_PROMPT_INIT _("Log In.")
 #define DEFAULT_EIDP_PROMPT_LINK _("Log in online with another device.")
+#define DEFAULT_SMARTCARD_PROMPT_INIT _("Insert smartcard")
+#define DEFAULT_SMARTCARD_PROMPT_PIN _("PIN")
 
 typedef errno_t (pam_set_prompting_fn_t)(TALLOC_CTX *, struct confdb_ctx *,
                                          const char *,
@@ -109,6 +112,7 @@ static errno_t pam_set_passkey_prompting_options(TALLOC_CTX *tmp_ctx,
 {
     bool passkey_interactive = false;
     char *passkey_interactive_prompt = NULL;
+    char *passkey_pin_prompt = NULL;
     bool passkey_touch = false;
     char *passkey_touch_prompt = NULL;
     int ret;
@@ -128,6 +132,12 @@ static errno_t pam_set_passkey_prompting_options(TALLOC_CTX *tmp_ctx,
         }
     }
 
+    ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_PASSKEY_PIN_PROMPT,
+                            DEFAULT_PASSKEY_PROMPT_PIN, &passkey_pin_prompt);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "confdb_get_string failed, using defaults");
+    }
+
     ret = confdb_get_bool(cdb, section, CONFDB_PC_PASSKEY_TOUCH, false,
                           &passkey_touch);
     if (ret != EOK) {
@@ -142,7 +152,8 @@ static errno_t pam_set_passkey_prompting_options(TALLOC_CTX *tmp_ctx,
         }
     }
 
-    ret = pc_list_add_passkey(pc_list, passkey_interactive_prompt, passkey_touch_prompt);
+    ret = pc_list_add_passkey(pc_list, passkey_interactive_prompt,
+                              passkey_pin_prompt, passkey_touch_prompt);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, "pc_list_add_passkey_touch failed.\n");
     }
@@ -179,6 +190,36 @@ static errno_t pam_set_eidp_prompting_options(TALLOC_CTX *tmp_ctx,
     return ret;
 }
 
+static errno_t
+pam_set_smartcard_prompting_options(TALLOC_CTX *tmp_ctx,
+                                    struct confdb_ctx *cdb,
+                                    const char *section,
+                                    struct prompt_config ***pc_list)
+{
+    char *init_prompt = NULL;
+    char *pin_prompt = NULL;
+    int ret;
+
+    ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_SMARTCARD_INIT_PROMPT,
+                            DEFAULT_SMARTCARD_PROMPT_INIT, &init_prompt);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "confdb_get_string failed, using defaults");
+    }
+
+    ret = confdb_get_string(cdb, tmp_ctx, section, CONFDB_PC_SMARTCARD_PIN_PROMPT,
+                            DEFAULT_SMARTCARD_PROMPT_PIN, &pin_prompt);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "confdb_get_string failed, using defaults");
+    }
+
+    ret = pc_list_add_smartcard(pc_list, init_prompt, pin_prompt);
+    if (ret != EOK) {
+        DEBUG(SSSDBG_OP_FAILURE, "pc_list_add_smartcard failed.\n");
+    }
+
+    return ret;
+}
+
 static errno_t pam_set_prompting_options(struct confdb_ctx *cdb,
                                          const char *service_name,
                                          char **sections,
@@ -293,14 +334,17 @@ errno_t pam_eval_prompting_config(struct pam_ctx *pctx, struct pam_data *pd,
     }
 
     if (types.cert_auth) {
-        /* If certificate based authentication is possilbe, i.e. a Smartcard
-         * or similar with the mapped certificate is available we currently
-         * prefer this authentication type unconditionally. If other types
-         * should be used the Smartcard can be removed during authentication.
-         * Since there currently are no specific options for cert_auth we are
-         * done. */
-        ret = EOK;
-        goto done;
+        ret = pam_set_prompting_options(pctx->rctx->cdb, pd->service,
+                                        pctx->prompting_config_sections,
+                                        pctx->num_prompting_config_sections,
+                                        CONFDB_PC_TYPE_SMARTCARD,
+                                        pam_set_smartcard_prompting_options,
+                                        &pc_list);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "pam_set_prompting_options failed.\n");
+            goto done;
+        }
     }
 
     /* If OTP and password auth are possible we currently prefer OTP. */

src/responder/pam/pamsrv_cmd.c

@@ -1545,9 +1545,12 @@ void pam_reply(struct pam_auth_req *preq)
         }
 #endif /* BUILD_PASSKEY */
 
+        DEBUG(SSSDBG_OP_FAILURE, "ikertxo: before ifdef\n"); //TODO: delete
 #ifdef HAVE_GDM_CUSTOM_JSON_PAM_EXTENSION
+        DEBUG(SSSDBG_OP_FAILURE, "ikertxo: after ifdef\n"); //TODO: delete
         if (is_pam_json_enabled(pctx->json_services,
                                 pd->service)) {
+            DEBUG(SSSDBG_OP_FAILURE, "ikertxo: after if1\n"); //TODO: delete
             ret = generate_json_auth_message(pctx->rctx->cdb, pc_list, pd);
             if (ret != EOK) {
                 DEBUG(SSSDBG_CRIT_FAILURE,