|
 |
57f72f |
From 4526858adb58736066a0b2cf2dc793ddfe671b2b Mon Sep 17 00:00:00 2001
|
|
|
57f72f |
From: ikerexxe <ipedrosa@redhat.com>
|
|
|
57f72f |
Date: Tue, 4 Aug 2020 15:39:51 +0200
|
|
|
57f72f |
Subject: [PATCH] config: allow prompting options in configuration
|
|
|
57f72f |
|
|
|
57f72f |
False warnings were logged after enabling prompting options in
|
|
|
57f72f |
configuration file. This change modifies the configuration rules to
|
|
|
57f72f |
allow prompting options.
|
|
|
57f72f |
|
|
|
57f72f |
Resolves:
|
|
|
57f72f |
https://github.com/SSSD/sssd/issues/5259
|
|
|
57f72f |
|
|
|
57f72f |
Reviewed-by: Sumit Bose <sbose@redhat.com>
|
|
|
57f72f |
---
|
|
|
57f72f |
src/config/cfg_rules.ini | 34 ++++++++++++++++++++++++++++++++++
|
|
|
57f72f |
1 file changed, 34 insertions(+)
|
|
|
57f72f |
|
|
|
57f72f |
diff --git a/src/config/cfg_rules.ini b/src/config/cfg_rules.ini
|
|
|
57f72f |
index 2874ea048..2d4e7b51d 100644
|
|
|
57f72f |
--- a/src/config/cfg_rules.ini
|
|
|
57f72f |
+++ b/src/config/cfg_rules.ini
|
|
|
57f72f |
@@ -14,6 +14,10 @@ section = session_recording
|
|
|
57f72f |
section_re = ^secrets/users/[0-9]\+$
|
|
|
57f72f |
section_re = ^secrets/secrets$
|
|
|
57f72f |
section_re = ^secrets/kcm$
|
|
|
57f72f |
+section_re = ^prompting/password$
|
|
|
57f72f |
+section_re = ^prompting/password/[^/\@]\+$
|
|
|
57f72f |
+section_re = ^prompting/2fa$
|
|
|
57f72f |
+section_re = ^prompting/2fa/[^/\@]\+$
|
|
|
57f72f |
section_re = ^domain/[^/\@]\+$
|
|
|
57f72f |
section_re = ^domain/[^/\@]\+/[^/\@]\+$
|
|
|
57f72f |
section_re = ^application/[^/\@]\+$
|
|
|
57f72f |
@@ -332,6 +336,36 @@ option = scope
|
|
|
57f72f |
option = users
|
|
|
57f72f |
option = groups
|
|
|
57f72f |
|
|
|
57f72f |
+# Prompting during authentication
|
|
|
57f72f |
+[rule/allowed_prompting_password_options]
|
|
|
57f72f |
+validator = ini_allowed_options
|
|
|
57f72f |
+section_re = ^prompting/password$
|
|
|
57f72f |
+
|
|
|
57f72f |
+option = password_prompt
|
|
|
57f72f |
+
|
|
|
57f72f |
+[rule/allowed_prompting_2fa_options]
|
|
|
57f72f |
+validator = ini_allowed_options
|
|
|
57f72f |
+section_re = ^prompting/2fa$
|
|
|
57f72f |
+
|
|
|
57f72f |
+option = single_prompt
|
|
|
57f72f |
+option = first_prompt
|
|
|
57f72f |
+option = second_prompt
|
|
|
57f72f |
+
|
|
|
57f72f |
+[rule/allowed_prompting_password_subsec_options]
|
|
|
57f72f |
+validator = ini_allowed_options
|
|
|
57f72f |
+section_re = ^prompting/password/[^/\@]\+$
|
|
|
57f72f |
+
|
|
|
57f72f |
+option = password_prompt
|
|
|
57f72f |
+
|
|
|
57f72f |
+[rule/allowed_prompting_2fa_subsec_options]
|
|
|
57f72f |
+validator = ini_allowed_options
|
|
|
57f72f |
+section_re = ^prompting/2fa/[^/\@]\+$
|
|
|
57f72f |
+
|
|
|
57f72f |
+option = single_prompt
|
|
|
57f72f |
+option = first_prompt
|
|
|
57f72f |
+option = second_prompt
|
|
|
57f72f |
+
|
|
|
57f72f |
+
|
|
|
57f72f |
[rule/allowed_domain_options]
|
|
|
57f72f |
validator = ini_allowed_options
|
|
|
57f72f |
section_re = ^\(domain\|application\)/[^/]\+$
|
|
|
57f72f |
--
|
|
|
57f72f |
2.21.3
|
|
|
57f72f |
|