On 21/09/2023 08:55, Sirio Sannipoli via FreeIPA-users wrote:
Thanks so much Sumit, your suggestion works perfectly. I'm still curious about the difference in behavior between distributions, but it's not that important. Greetings
Probably on RHEL you have pam_sssd in your PAM stack, which is able to present separate prompts for both factors; whereas on Debian you have pam_unix which can only present a "Password:" prompt.
This happens because pam_unix is registered in Debian's pam-auth-update mechanism with priority 256, whereas pam_sss is only registred with priority 128. Thus, the 'common-auth' PAM stack (which is included by sshd, login, gdm, etc) has pam_auth.so first, which prompts for the password; then pam_sss.so is called, with the 'use_first_pass' option, so it uses the password stashed by pam_unix.so instead of presenting its own prompts.
I think pam_sss's priority should be bumped but I've not gotten around to chasing this request:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1001644 -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9 _______________________________________________ FreeIPA-users mailing list -- freeipa-users@lists.fedorahosted.org To unsubscribe send an email to freeipa-users-le...@lists.fedorahosted.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedorahosted.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
