SSSD / sssd

#3888 need option in pam_sss for one prompt
Closed: duplicate Opened by hedrick.

Closed: duplicate
Reopen Issue

I'm using pam_sss to authenticate a web application. I'm using sss rather than ldap because I need the user to end up with a Kerberos credential on the system. If the user has a one-time password, pam_sss attempts to prompt twice. Almost no web applications will work with that.

Currently I put pam_unix before pam_sss. Pam_unix gets the password and fails. pam_sss then uses the password. But this is kind of silly. There should be an option to get only one password. Obviously this can't work for every type of OTP technology, but for the most common there are ways to put everything on one line.

We already have https://pagure.io/SSSD/sssd/issue/3264 for this.

Metadata Update from @sbose:
- Issue close_status updated to: duplicate
- Issue status updated to: Closed (was: Open)

The other ticket works as long as it's done as pam options. The request in that ticket is for something in sssd.conf. We only want this for some services.

The other ticket works as long as it's done as pam options. The request in that ticket is for something in sssd.conf. We only want this for some services.

yes, the idea is that you can says which configuration should be used for which service in sssd.conf.

Please, allow this for ssh connections (and sudo, ok, all sssd authorised services :) ) too. We have per host 2FA and we'd like to remove the "Second Factor (optional):" prompt from those hosts that do not require 2FA.

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/4874

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
None
High
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.