Ldap subtree browsing and ulrlist format about yubico-pam

[klali]

Hello,

As for ldap with subtree search that is used if you use the ldap_filter
option. Maybe we should add a parameter for setting the scope explicitly.
Currently no direct plans to change this.

For urllist it looks like you're quoting the string which doesn't seem to
parse correctly, remove the quotes and see how it behaves.

/klas

On Wed, Jul 22, 2015 at 4:32 PM, kai1074 [email protected] wrote:

Hello list,
I'm implementing 2FA with yubico and ldap, and at the moment everything
works fine (storing and retrieving yubikeyID from ldap ean authenticating
user via pam).
The first problem I'm facing is thata pam_yubico.so module doesn't perform
ldap subtree search, ad so users must be limited to to the ldapdn, and so a
user cn=foo,ou=user,dc=example,dc=com is found, while
cn=foo,ou=extern,ou=user,dc=example,dc=com is not found.
The version from https://github.com/alexjfisher/yubico-pam overcomes this
problem, but i'd prefer to use the official version: do you plan to
integrate such a change?
Another thing (as in the subject) is the urllist format: using
urllist="
http://infra-ldapm-vr1/wsapi/2.0/verify;http://infra-ldaps-vr1/wsapi/2.0/verify"
returns
the following (snippet)
[pam_yubico.c:parse_cfg(810)] urllist="
http://infra-ldapm-vr1/wsapi/2.0/verify;http://infra-ldaps-vr1/wsapi/2.0/verify
"
[pam_yubico.c:parse_cfg(811)]
capath=/etc/ssl/private/ldapmBase64-infracomspa.it.cer
[pam_yubico.c:parse_cfg(812)] token_id_length=12
[pam_yubico.c:parse_cfg(813)] mode=client
[pam_yubico.c:parse_cfg(814)] chalresp_path=(null)
[pam_yubico.c:pam_sm_authenticate(856)] get user returned: scailotto
[pam_yubico.c:pam_sm_authenticate(877)] get password returned: (null)
[pam_yubico.c:pam_sm_authenticate(999)] conv returned 44 bytes
[pam_yubico.c:pam_sm_authenticate(1017)] Skipping first 0 bytes. Length is
44, token_id set to 12 and token OTP always 32.
[pam_yubico.c:pam_sm_authenticate(1024)] OTP:
bedlceglbecignuigciulnfhvliefjifcelrujiidhfi ID: bedlceglbeci
[pam_yubico.c:pam_sm_authenticate(1055)] ykclient return value (101):
Could not parse server response
[pam_yubico.c:pam_sm_authenticate(1116)] done. [Authentication service
cannot retrieve authentication info]

I see by the validation server logs that only the last one in the list is
queried, and it works successfuly, but it seems the reply is not correct;
using one single server in urllist (no matter which one) works correctly.
I get the same behaviour both with "official" pam_yubico and with
alexjfisher's one.

What's wrong?
Best Regards,
Stefano

—
Reply to this email directly or view it on GitHub
#69.