2FA - prompting - single_prompt

[Winfried de Heiden]

Hi all,

Using FreeIPA, 2FA can be made optional by enabling "Password" AND "Two 
factor authentication (password + OTP)" for a user. For particular hosts 
the 2FA now can be made mandatory by enabling "Two factor authentication 
(password + OTP)"

Now, for hosts for which 2FA is NOT mandatory, according to the man 
pages, 2FA can be made "invissible" by using the "single_prompt" option. 
In man sssd.conf:

"If the second factor is optional and it should be possible to log in 
either only with the password or with both factors two-step prompting 
has to be used."

However, this doesn't work. When using the "single_prompt" login will 
fail. Using two prompts, and just press enter for the second 2FA prompt, 
login will succeed.

Hence: did I forget something or is there a bug involved?

FYI: tested on CentOS Stream9

[Sumit Bose]

Am Thu, Dec 23, 2021 at 01:13:32PM +0100 schrieb Winfried de Heiden via FreeIPA-users:
> Hi all,
>
> Using FreeIPA, 2FA can be made optional by enabling "Password" AND "Two
> factor authentication (password + OTP)" for a user. For particular hosts the
> 2FA now can be made mandatory by enabling "Two factor authentication
> (password + OTP)"
>
> Now, for hosts for which 2FA is NOT mandatory, according to the man pages,
> 2FA can be made "invissible" by using the "single_prompt" option. In man
> sssd.conf:
>
> "If the second factor is optional and it should be possible to log in either
> only with the password or with both factors two-step prompting has to be
> used."

Hi,

the sentence from the man page is not part of the description of the
'single_prompt' option but a general comment for '[prompting/2fa]'. And
it means that in your case 'single_prompt' won't work because "two-step
prompting" with first and second factor "has to be used".

HTH

bye,
Sumit
> However, this doesn't work. When using the "single_prompt" login will fail.
> Using two prompts, and just press enter for the second 2FA prompt, login
> will succeed.
>
> Hence: did I forget something or is there a bug involved?
>
> FYI: tested on CentOS Stream9
>
> -- 
> email handtekening privé Met vriendelijke groet,
>
> Winfried de Heiden
> [e-mail]
> FreeIPA-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail]...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure