[15634] in Kerberos_V5_Development
Re: prompter type question
daemon@ATHENA.MIT.EDU (Jeffrey Hutzelman)
Tue Mar 23 15:14:16 2010
Date: Tue, 23 Mar 2010 12:14:03 -0700
From: Jeffrey Hutzelman <jhutz@cmu.edu>
To: Nicolas Williams <Nicolas.Williams@sun.com>
Message-ID: <A122D082FEAB101F4368CCE7@atlantis.pc.cs.cmu.edu>
In-Reply-To: <20100323190048.GQ21244@Sun.COM>
MIME-Version: 1.0
Content-Disposition: inline
Cc: MIT Kerberos Dev List <krbdev@mit.edu>, jhutz@cmu.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
--On Tuesday, March 23, 2010 02:00:48 PM -0500 Nicolas Williams
<Nicolas.Williams@sun.com> wrote:
> On Tue, Mar 23, 2010 at 11:51:41AM -0700, Jeffrey Hutzelman wrote:
>> --On Tuesday, March 23, 2010 12:31:09 PM -0400 Greg Hudson
>> <ghudson@mit.edu> wrote:
>> > Can I have a bit more information about what Sun's pam_krb5
>> > implementation wants to do with the prompt types? We can probably add
>> > these three once I understand the need for them.
>>
>> I don't speak for Sun, but...
>
> ... you did a good job :)
>
>> It's important that PAM modules be able to distinguish prompts for
>> multiple things from each other, so that they can correctly
>> associate prompts with previously-collected replies when retrying an
>> operation after a conversation function returns PAM_CONV_AGAIN.
>>
>> In addition, as the PAM framework's ability to pass
>> previously-entered responses between modules improves, it is
>> important for PAM modules to be able to tell what a prompt is for,
>> so they can convey it correctly to other modules. It would be bad
>> to record the answer to a PIN prompt as if it were a password; we
>> have recently discussed the implications of such confusion.
Actually, I missed mentioning another reason for having distinct prompt
types for each piece of information, and for things like "insert token".
The client may not necessarily be a PAM module. In fact, it might be some
kind of indirection or automation, in which case it would need separate
prompt types in order to have a prayer of understanding what you're asking
it to do.
-- Jeff
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
