[Freeipa-users] Re: SSSD prompting/2fa

2022-07-16 Thread Sam Morris via FreeIPA-users
On 16/07/2022 04:08, Jacob M Cutright via FreeIPA-users wrote: Hello, Apologies if I am misunderstanding and this is incorrect, but users who log in via SSH keys do not get Kerberos tickets by default, which is why your pam_sss_sudo isn't working. You can reference this issue here: https://pa

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-15 Thread Jochen Kellner via FreeIPA-users
Hello, Jacob M Cutright via FreeIPA-users writes: > It would be nice if ansible.cfg had keytab support I'm not sure what you mean/want here. I'm using an LDAP inventory from FreeIPA in ansible. Authentication on the clients uses authorized_keys here (no kerberos). Until recently I did a manual

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-15 Thread Jacob M Cutright via FreeIPA-users
Hello, Apologies if I am misunderstanding and this is incorrect, but users who log in via SSH keys do not get Kerberos tickets by default, which is why your pam_sss_sudo isn't working. You can reference this issue here: https://pagure.io/freeipa/issue/4000/ I have been wondering the same thi

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-15 Thread Sam Morris via FreeIPA-users
On 08/07/2022 07:57, Sigbjorn Lie-Soland wrote: On 8 Jun 2022, at 10:26, Sam Morris via FreeIPA-users wrote: On 03/06/2022 08:19, Sigbjorn Lie via FreeIPA-users wrote: Hi list, When I have a 2FA enabled user account, I receive the two password prompt for sudo at a host, even on hosts wher

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-10 Thread Sumit Bose via FreeIPA-users
Am Fri, Jul 08, 2022 at 09:28:34PM +0200 schrieb Sigbjorn Lie-Soland: > > > > On 8 Jul 2022, at 12:18, Sumit Bose wrote: > > > > Am Fri, Jul 08, 2022 at 11:47:13AM +0200 schrieb Sigbjorn Lie-Soland: > >> > >> > >>> On 8 Jul 2022, at 08:38, Sumit Bose wrote: > >>> > >>> Am Fri, Jun 03, 2022

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-08 Thread Sigbjorn Lie-Soland via FreeIPA-users
> On 8 Jul 2022, at 12:18, Sumit Bose wrote: > > Am Fri, Jul 08, 2022 at 11:47:13AM +0200 schrieb Sigbjorn Lie-Soland: >> >> >>> On 8 Jul 2022, at 08:38, Sumit Bose wrote: >>> >>> Am Fri, Jun 03, 2022 at 09:19:51AM +0200 schrieb Sigbjorn Lie via >>> FreeIPA-users: Hi list,

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-08 Thread Sumit Bose via FreeIPA-users
Am Fri, Jul 08, 2022 at 11:47:13AM +0200 schrieb Sigbjorn Lie-Soland: > > > > On 8 Jul 2022, at 08:38, Sumit Bose wrote: > > > > Am Fri, Jun 03, 2022 at 09:19:51AM +0200 schrieb Sigbjorn Lie via > > FreeIPA-users: > >> Hi list, > >> > >> When I have a 2FA enabled user account, I receive the t

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-08 Thread Sigbjorn Lie-Soland via FreeIPA-users
> On 8 Jul 2022, at 08:38, Sumit Bose wrote: > > Am Fri, Jun 03, 2022 at 09:19:51AM +0200 schrieb Sigbjorn Lie via > FreeIPA-users: >> Hi list, >> >> When I have a 2FA enabled user account, I receive the two password prompt >> for sudo at a host, even on hosts where 2FA is not required. This

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-07 Thread Sigbjorn Lie-Soland via FreeIPA-users
> On 8 Jun 2022, at 10:26, Sam Morris via FreeIPA-users > wrote: > > On 03/06/2022 08:19, Sigbjorn Lie via FreeIPA-users wrote: >> Hi list, >> When I have a 2FA enabled user account, I receive the two password prompt >> for sudo at a host, even on hosts where 2FA is not required. This breaks

[Freeipa-users] Re: SSSD prompting/2fa

2022-07-07 Thread Sumit Bose via FreeIPA-users
Am Fri, Jun 03, 2022 at 09:19:51AM +0200 schrieb Sigbjorn Lie via FreeIPA-users: > Hi list, > > When I have a 2FA enabled user account, I receive the two password prompt > for sudo at a host, even on hosts where 2FA is not required. This breaks > Ansible for me, when using "become" with Ansible. >

[Freeipa-users] Re: SSSD prompting/2fa

2022-06-08 Thread Sam Morris via FreeIPA-users
On 03/06/2022 08:19, Sigbjorn Lie via FreeIPA-users wrote: Hi list, When I have a 2FA enabled user account, I receive the two password prompt for sudo at a host, even on hosts where 2FA is not required. This breaks Ansible for me, when using "become" with Ansible. A way forward might be to u