Zen

Source string Source string

422/10000 · 422

The string is read-only.

English Actions
PROMPTING CONFIGURATION SECTION
If a special file (<filename>/var/lib/sss/pubconf/pam_preauth_available</filename>) exists SSSD's PAM module pam_sss will ask SSSD to figure out which authentication methods are available for the user trying to log in. Based on the results pam_sss will prompt the user for appropriate credentials.
With the growing number of authentication methods and the possibility that there are multiple ones for a single user the heuristic used by pam_sss to select the prompting might not be suitable for all use cases. The following options should provide a better flexibility here.
[prompting/password]
password_prompt
to change the string of the password prompt
to configure password prompting, allowed options are: <placeholder type="variablelist" id="0"/>
[prompting/2fa]
first_prompt
to change the string of the prompt for the first factor
second_prompt
to change the string of the prompt for the second factor
single_prompt
boolean value, if True there will be only a single prompt using the value of first_prompt where it is expected that both factors are entered as a single string. Please note that both factors have to be entered here, even if the second factor is optional.
to configure two-factor authentication prompting, allowed options are: <placeholder type="variablelist" id="0"/> If the second factor is optional and it should be possible to log in either only with the password or with both factors two-step prompting has to be used.
Some clients, such as SSH with 'PasswordAuthentication yes', generate their own prompts and do not use prompts provided by SSSD or other PAM modules. Additionally, for SSH with PasswordAuthentication, if two-factor authentication is available, SSSD expects that the credentials entered by the user at the SSH password prompt will always be the two factors in a single string, even if two-factor authentication is optional.
[prompting/passkey]
interactive
boolean value, if True prompt a message and wait before testing the presence of a passkey device. Recommended if your device doesn’t have a tactile trigger.
interactive_prompt
to change the message of the interactive prompt.
touch
boolean value, if True prompt a message to remind the user to touch the device.
touch_prompt
to change the message of the touch prompt.
to configure passkey authentication prompting, allowed options are: <placeholder type="variablelist" id="0"/>
Each supported authentication method has its own configuration subsection under <quote>[prompting/...]</quote>. Currently there are: <placeholder type="variablelist" id="0"/> <placeholder type="variablelist" id="1"/> <placeholder type="variablelist" id="2"/>
It is possible to add a subsection for specific PAM services, e.g. <quote>[prompting/password/sshd]</quote> to individual change the prompting for this service.
EXAMPLES
[sssd]
domains = LDAP
services = nss, pam

[nss]
filter_groups = root
filter_users = root

[pam]

[domain/LDAP]
id_provider = ldap
ldap_uri = ldap://ldap.example.com
ldap_search_base = dc=example,dc=com

auth_provider = krb5
krb5_server = kerberos.example.com
krb5_realm = EXAMPLE.COM
cache_credentials = true

min_id = 10000
max_id = 20000
enumerate = False
1. The following example shows a typical SSSD config. It does not describe configuration of the domains themselves - refer to documentation on configuring domains for more details. <placeholder type="programlisting" id="0"/>

Loading…

User avatar None

String added in the repository
Some clients, such as SSH with 'PasswordAuthentication yes', generate their own prompts and do not use prompts provided by SSSD or other PAM modules. Additionally, for SSH with PasswordAuthentication, if two-factor authentication is available, SSSD expects that the credentials entered by the user at the SSH password prompt will always be the two factors in a single string, even if two-factor authentication is optional.
Some clients, such as SSH with 'PasswordAuthentication yes', generate their own prompts and do not use prompts provided by SSSD or other PAM modules. Additionally, for SSH with PasswordAuthentication, if two-factor authentication is available, SSSD expects that the credentials entered by the user at the SSH password prompt will always be the two factors in a single string, even if two-factor authentication is optional.
4 months ago
Browse all string changes

Things to check

Long untranslated

The string has not been translated for a long time

Reset

Glossary

English English
No related strings found in the glossary.

18418570 String information

Source string description
type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
Flags
read-only
Source string location
sssd.conf.5.xml:4548
String age
4 months ago
Last updated
4 months ago
Source string age
4 months ago
Translation file
src/man/po/sssd-docs.pot, string 800