[15604] in Kerberos_V5_Development
Re: prompter type question
daemon@ATHENA.MIT.EDU (Nicolas Williams)
Tue Mar 16 16:10:52 2010
Date: Tue, 16 Mar 2010 15:10:14 -0500
From: Nicolas Williams <Nicolas.Williams@sun.com>
To: MIT Kerberos Dev List <krbdev@mit.edu>
Message-ID: <20100316201014.GZ14993@Sun.COM>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <20100316190949.GA20151@sun.com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Tue, Mar 16, 2010 at 02:09:49PM -0500, Will Fiveash wrote:
> I'm looking at modifying the pkinit preauth plugin to prompt the user to
> insert their token and press Enter if the code doesn't find a token.
> While making this mod I came across these defines in krb5.h:
>
> /*
> * Prompter enhancements
> */
>
> #define KRB5_PROMPT_TYPE_PASSWORD 0x1
> #define KRB5_PROMPT_TYPE_NEW_PASSWORD 0x2
> #define KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN 0x3
> #define KRB5_PROMPT_TYPE_PREAUTH 0x4
>
> My question; what is the proper prompt type for the prompt I'm creating
> (a reminder prompt that isn't asking for a PIN or password)?
IMO yours is a distinct prompt type.
KRB5_PROMPT_TYPE_PREAUTH should be used for such things as impending
password expiry warnings, as well as error messages. A specific prompt
type should generally be required any time the user has to take action
in response to a prompt in order to proceed:
- password
- new password
- new password again
- challenge/response
- OTP
- OTP sync
- PIN
- "insert smartcard if you have one"
- biometrics
That's probably a reasonably complete set.
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
