Sumit Bose f0d12b7f1b ipa-kdb: Remove keys if password auth is disabled ... With commit 15ff9c8 a check was removed and as a result Kerberos keys are unconditionally added to the user entry struct if they are available. As a result the password related pre-authentication methods PA-ENC-TIMESTAMP and PA-ETYPE-INFO2 are advertised in the NEEDED_PREAUTH reply to an AS_REQ. With respect to the KDC policies this does not matter much because if password authentication is disabled for the given principal the policy will reject the AS_REQ if the user tries password authentication. This is possible because with commit 15ff9c8 kinit will ask for a password if called without any additional options (e.g. armor ticket or PKINIT identity). Before 15ff9c8 was committed it just failed with 'kinit: Pre-authentication failed: Invalid argument while getting initial credentials' because no suitable pre-authentication method was available. This is the same behavior as if no password was set for the given principal. But with this change SSSD fails to detect the available authentication types for the given principal properly. As described in https://docs.pagure.org/SSSD.sssd/design_pages/prompting_for_multiple_authentication_types.html SSSD uses the MIT Kerberos responder interface to determine the available authentication methods for the principal and does not check the ipaUserAuthType LDAP attribute. As a result if a user has 2FA (otp) authentication configured, which implies that a password is set as the first factor, the responder interface will always indicate that password authentication is available even if only opt is enabled for the user. In this case SSSD will use a prompting which indicates that the second factor might be optional. Additionally if prompting the user directly is not possible (e.g. ssh with ChallengeResponseAuthentication / KbdInteractiveAuthentication disabled) the single string entered by the user will always be assumed as a password and not as a combination of password and otp-token value. As a consequence authentication will always fail because password authentication is disabled for the user and since SSSD does not do try-and-error 2FA is not tried. This patch add back the check so that if password authentication is not available for the principal the Kerberos will not be added to the entry struct and the KDC will not advertise PA-ENC-TIMESTAMP or PA-ETYPE-INFO2. If you think this is wrong and the behavior added by 15ff9c8 should be preferred SSSD handing of the available authentication types must be extended to read ipaUserAuthType as well to restore the user experience with respect to 2FA prompting and ssh behavior. Related to https://pagure.io/freeipa/issue/8001 Reviewed-By: Robbie Harwood <rharwood@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>		2019-12-13 03:49:47 +02:00
..
dnssec	Replace PYTHONSHEBANG with valid shebang	2019-06-24 09:35:57 +02:00
ipa-kdb	ipa-kdb: Remove keys if password auth is disabled	2019-12-13 03:49:47 +02:00
ipa-otpd	Py3: Replace six.moves imports	2018-10-05 12:06:19 +02:00
ipa-sam	Add local helpers to handle unixid structure	2019-10-01 10:38:00 -04:00
ipa-slapi-plugins	extdom: use sss_nss_*_timeout calls	2019-09-12 10:48:13 +03:00
ipa-version.h.in	Build: move version handling from Makefile to configure	2016-11-09 13:08:32 +01:00
Makefile.am	Build: properly integrate ipa-version.h.in into build system	2016-11-29 15:28:24 +01:00