pam: keep preauth indicator for socket activation

[Apollo3zehn]

I ran into this while testing IdP login through ssh on a Debian system with socket activated responders.

After the PAM responder was idle for a while, it exited and removed the pam_preauth_available file. The next ssh login then showed a Password prompt first. Pressing enter still started the IdP device flow, and the next login worked directly again because the responder was running by then.

This changes the pam_sss preauth check so it also tries preauth when the PAM responder socket exists. In that case the socket can start the responder and preauth can return the device flow prompt directly.

I tested this locally with a rebuilt package by stopping/letting the PAM responder go away so the indicator file was absent while /var/lib/sss/pipes/pam still existed. With this patch the ssh login showed the device flow prompt directly instead of Password first.

[sumit-bose]

Hi,

thank you for making us aware of the issue and the patch. But I think your solution basically makes the PAM_PREAUTH_INDICATOR file useless because the PAM socket well always be available if SSSD is running either permanently or socket activated. I wonder if you can check if the PAM responder would not remove the PAM_PREAUTH_INDICATOR, e.g. by not calling atexit(cleanup_preauth_indicator) in create_preauth_indicator() if the PAM responder is socket activated (socket_activated member in struct resp_ctx), it will work as well?

bye,
Sumit

[Apollo3zehn]

Hi Sumit,

yes, I tested your suggested approach locally.

I removed the client-side PAM socket fallback and changed the responder-side indicator handling instead, so create_preauth_indicator() does not register atexit(cleanup_preauth_indicator) when the responder is socket-activated.

With a rebuilt Debian package I forced the relevant state:

• sssd-pam.service inactive
• /var/lib/sss/pipes/pam present
• /var/lib/sss/pubconf/pam_preauth_available present

Then I retried the SSH IdP login. The device authorization prompt was shown directly, without a preceding password prompt :-)

[sumit-bose]

Hi,

thank you for the update. Please squash the two patches into one and it would be nice if you can add a short comment in src/util/util_preauth.c why we do not want to delete the file if the responder is socket activated.

bye,
Sumit

[Apollo3zehn]

Done as requested

[alexey-tikhonov]

(Not introduced by this PR, but worth fixing while here)
tmp_ctx is unsed and can be removed.

[Apollo3zehn]

I deleted all references to tmp_ctx

[alexey-tikhonov]

@sumit-bose, maybe it makes sense to cleanup_preauth_indicator() at else branch of

sssd/src/responder/pam/pamsrv.c

Line 321 in db521e9

if (pctx->cert_auth

?

Otherwise on systems with socket activated PAM responder (and without IPA provider), once created file will never be cleared, even if config changes.

[sumit-bose]

Hi,

that's a good idea. I was wondering as well where a cleanup, when the configuration changes, can be implemented.

bye,
Sumit

[alexey-tikhonov]

@Apollo3zehn, mind adding this please?

[Apollo3zehn]

Done