From 006d3f9e15c843e31b99b62cfd55eaf068c66afb Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Thu, 19 Mar 2026 11:14:38 +0100 Subject: [PATCH 1/8] Allow non-root processes to use the PAM service The permission check was introduced in #311 to: 1. "prevent spamming the service with invalid authentication request", and 2. "prevent some NSS (shadow) requests" Regarding 1., our assessment is that it's not feasible to protect against DoS from a local user. For example, all D-Bus services accessible to unprivileged users on the system bus are also prone to DoS. Regarding 2., the shadow requests (GetShadowEntries and GetShadowByName) were dropped in 62ffae0fee6b331c4003bac0b9bd8d153dfe91e9 without replacement. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/services/manager.go | 2 +- internal/services/manager_test.go | 4 +- internal/services/pam/pam.go | 13 +- internal/services/pam/pam_test.go | 112 ++++-------------- internal/services/pam/permissions.go | 8 -- .../Error_when_not_root/IsAuthenticated | 4 - .../Error_when_not_root/cache.db | 4 - internal/services/permissions.go | 24 ---- internal/services/permissions/testutils.go | 14 --- internal/services/user/permissions.go | 10 -- internal/services/user/user_test.go | 12 +- pam/integration-tests/cli_test.go | 45 ++----- pam/integration-tests/native_test.go | 43 ++----- ..._if_current_user_is_not_considered_as_root | 11 -- ...t_user_is_not_root_as_can_not_authenticate | 11 -- ..._if_current_user_is_not_considered_as_root | 10 -- ...t_user_is_not_root_as_can_not_authenticate | 10 -- 17 files changed, 51 insertions(+), 286 deletions(-) delete mode 100644 internal/services/pam/permissions.go delete mode 100644 internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated delete mode 100644 internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db delete mode 100644 internal/services/permissions.go delete mode 100644 internal/services/user/permissions.go delete mode 100644 pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root delete mode 100644 pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate delete mode 100644 pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root delete mode 100644 pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate diff --git a/internal/services/manager.go b/internal/services/manager.go index 1c28c3e031..ffd363cefb 100644 --- a/internal/services/manager.go +++ b/internal/services/manager.go @@ -57,7 +57,7 @@ func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBr func (m Manager) RegisterGRPCServices(ctx context.Context) *grpc.Server { log.Debug(ctx, "Registering gRPC services") - opts := []grpc.ServerOption{permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(m.globalPermissions, errmessages.RedactErrorInterceptor)} + opts := []grpc.ServerOption{permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)} grpcServer := grpc.NewServer(opts...) healthCheck := health.NewServer() diff --git a/internal/services/manager_test.go b/internal/services/manager_test.go index 01fd3f59e7..d155fc014d 100644 --- a/internal/services/manager_test.go +++ b/internal/services/manager_test.go @@ -100,10 +100,10 @@ func TestAccessAuthorization(t *testing.T) { conn, err := grpc.NewClient("unix://"+socketPath, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithUnaryInterceptor(errmessages.FormatErrorMessage)) require.NoError(t, err, "Setup: could not dial the server") - // Global authorization for PAM is always denied for non root user. + // PAM calls are allowed for non-root users. pamClient := authd.NewPAMClient(conn) _, err = pamClient.AvailableBrokers(context.Background(), &authd.Empty{}) - require.Error(t, err, "PAM calls are not allowed to any random user") + require.NoError(t, err, "PAM calls should be allowed for non-root users") // Global authorization for the user service is always granted for non root user. userServiceClient := authd.NewUserServiceClient(conn) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 8127df2dff..6c0fe8aba0 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -14,7 +14,6 @@ import ( "github.com/canonical/authd/internal/brokers/layouts" "github.com/canonical/authd/internal/decorate" "github.com/canonical/authd/internal/proto/authd" - "github.com/canonical/authd/internal/services/permissions" "github.com/canonical/authd/internal/users" "github.com/canonical/authd/internal/users/types" "github.com/canonical/authd/log" @@ -27,21 +26,19 @@ var _ authd.PAMServer = Service{} // Service is the implementation of the PAM module service. type Service struct { - userManager *users.Manager - brokerManager *brokers.Manager - permissionManager *permissions.Manager + userManager *users.Manager + brokerManager *brokers.Manager authd.UnimplementedPAMServer } // NewService returns a new PAM GRPC service. -func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager, permissionManager *permissions.Manager) Service { +func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager) Service { log.Debug(ctx, "Building new gRPC PAM service") return Service{ - userManager: userManager, - brokerManager: brokerManager, - permissionManager: permissionManager, + userManager: userManager, + brokerManager: brokerManager, } } diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 29ba17cc63..46329f61a2 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -73,8 +73,7 @@ func TestNewService(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, t.TempDir()) require.NoError(t, err, "Setup: could not create user manager") - pm := permissions.New() - service := pam.NewService(context.Background(), m, globalBrokerManager, &pm) + service := pam.NewService(context.Background(), m, globalBrokerManager) brokers, err := service.AvailableBrokers(context.Background(), &authd.Empty{}) require.NoError(t, err, "can’t create the service directly") @@ -85,20 +84,15 @@ func TestAvailableBrokers(t *testing.T) { t.Parallel() tests := map[string]struct { - currentUserNotRoot bool - wantErr bool }{ "Success_getting_available_brokers": {}, - - "Error_when_not_root": {currentUserNotRoot: true, wantErr: true}, } for name, tc := range tests { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) abResp, err := client.AvailableBrokers(context.Background(), &authd.Empty{}) @@ -128,8 +122,7 @@ func TestGetBroker(t *testing.T) { tests := map[string]struct { user string - currentUserNotRoot bool - onlyLocalBroker bool + onlyLocalBroker bool wantBroker string wantErr bool @@ -142,8 +135,6 @@ func TestGetBroker(t *testing.T) { "Returns_empty_when_user_does_not_exist": {user: "nonexistent@example.com", wantBroker: ""}, "Returns_empty_when_user_does_not_have_a_broker": {user: "userwithoutbroker@example.com", wantBroker: ""}, "Returns_empty_when_broker_is_not_available": {user: "userwithinactivebroker@example.com", wantBroker: ""}, - - "Error_when_not_root": {user: "userwithbroker@example.com", currentUserNotRoot: true, wantErr: true}, } for name, tc := range tests { t.Run(name, func(t *testing.T) { @@ -164,14 +155,13 @@ func TestGetBroker(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, dbDir) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) brokerManager := globalBrokerManager if tc.onlyLocalBroker { brokerManager, err = brokers.NewManager(context.Background(), "", nil) require.NoError(t, err, "Setup: could not create broker manager with only local broker") } - client := newPamClient(t, m, brokerManager, &pm) + client := newPamClient(t, m, brokerManager) // Get existing entry gotResp, err := client.GetBroker(context.Background(), &authd.GBRequest{Username: tc.user}) @@ -196,14 +186,11 @@ func TestSelectBroker(t *testing.T) { sessionMode string existingDB string - currentUserNotRoot bool - wantErr bool }{ "Successfully_select_a_broker_and_creates_auth_session": {username: "success@example.com", sessionMode: auth.SessionModeLogin}, "Successfully_select_a_broker_and_creates_passwd_session": {username: "success@example.com", sessionMode: auth.SessionModeChangePassword}, - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_username_is_empty": {wantErr: true}, "Error_when_mode_is_empty": {sessionMode: "-", wantErr: true}, "Error_when_mode_does_not_exist": {sessionMode: "does not exist", wantErr: true}, @@ -228,8 +215,7 @@ func TestSelectBroker(t *testing.T) { require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) switch tc.brokerID { case "": @@ -279,15 +265,13 @@ func TestGetAuthenticationModes(t *testing.T) { sessionID string supportedUILayouts []*authd.UILayout - username string - currentUserNotRoot bool + username string wantErr bool }{ "Successfully_get_authentication_modes": {}, "Successfully_get_multiple_authentication_modes": {username: "gam_multiple_modes@example.com"}, - "Error_when_not_root": {currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_passing_invalid_layout": {supportedUILayouts: []*authd.UILayout{emptyType}, wantErr: true}, "Error_when_sessionID_is_invalid": {sessionID: "invalid-session", wantErr: true}, @@ -298,8 +282,7 @@ func TestGetAuthenticationModes(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -312,9 +295,6 @@ func TestGetAuthenticationModes(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - if tc.supportedUILayouts == nil { tc.supportedUILayouts = []*authd.UILayout{requiredEntry} } @@ -346,7 +326,6 @@ func TestSelectAuthenticationMode(t *testing.T) { username string supportedUILayouts []*authd.UILayout noValidators bool - currentUserNotRoot bool wantErr bool }{ @@ -354,7 +333,6 @@ func TestSelectAuthenticationMode(t *testing.T) { "Successfully_select_mode_with_missing_optional_value": {username: "sam_missing_optional_entry@example.com", supportedUILayouts: []*authd.UILayout{optionalEntry}}, // service errors - "Error_when_not_root": {username: "sam_success_required_entry@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_session_ID_is_invalid": {sessionID: "invalid-session", wantErr: true}, "Error_when_no_authmode_is_selected": {sessionID: "no auth mode", authMode: "-", wantErr: true}, @@ -373,8 +351,7 @@ func TestSelectAuthenticationMode(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -405,9 +382,6 @@ func TestSelectAuthenticationMode(t *testing.T) { require.NoError(t, err, "Setup: failed to get authentication modes for tests") } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - samReq := &authd.SAMRequest{ SessionId: tc.sessionID, AuthenticationModeId: tc.authMode, @@ -430,11 +404,10 @@ func TestIsAuthenticated(t *testing.T) { sessionID string existingDB string - username string - secondCall bool - cancelFirstCall bool - localGroupsFile string - currentUserNotRoot bool + username string + secondCall bool + cancelFirstCall bool + localGroupsFile string // There is no wantErr as it's stored in the golden file. }{ @@ -449,7 +422,6 @@ func TestIsAuthenticated(t *testing.T) { "Successfully_authenticate_with_groups_with_uppercase": {username: "success_with_uppercase_groups@example.com"}, // service errors - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true}, "Error_when_sessionID_is_empty": {sessionID: "-"}, "Error_when_there_is_no_broker": {sessionID: "invalid-session"}, "Error_when_user_is_locked": {username: "locked@example.com", existingDB: "cache-with-locked-user.db"}, @@ -493,8 +465,7 @@ func TestIsAuthenticated(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, dbDir, managerOpts...) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -507,9 +478,6 @@ func TestIsAuthenticated(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - var firstCall, secondCall string ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -601,8 +569,7 @@ func TestIDGeneration(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, t.TempDir(), managerOpts...) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) sbResp, err := client.SelectBroker(context.Background(), &authd.SBRequest{ BrokerId: mockBrokerGeneratedID, @@ -626,9 +593,8 @@ func TestSetBroker(t *testing.T) { t.Parallel() tests := map[string]struct { - username string - brokerID string - currentUserNotRoot bool + username string + brokerID string wantErr bool }{ @@ -637,7 +603,6 @@ func TestSetBroker(t *testing.T) { "Username_is_case_insensitive": {username: "UserSetBroker@example.com"}, "Error_when_setting_broker_to_local_broker": {username: "userlocalbroker@example.com", brokerID: brokers.LocalBrokerName, wantErr: true}, - "Error_when_not_root": {username: "usersetbroker@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_username_is_empty": {wantErr: true}, "Error_when_user_does_not_exist_": {username: "doesnotexist@example.com", wantErr: true}, "Error_when_broker_does_not_exist": {username: "userwithbroker@example.com", brokerID: "does not exist", wantErr: true}, @@ -653,8 +618,7 @@ func TestSetBroker(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, dbDir) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) if tc.brokerID == "" { tc.brokerID = mockBrokerGeneratedID @@ -689,14 +653,12 @@ func TestEndSession(t *testing.T) { tests := map[string]struct { sessionID string - username string - currentUserNotRoot bool + username string wantErr bool }{ "Successfully_end_session": {username: "success@example.com"}, - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_sessionID_is_invalid": {sessionID: "invalid-session", wantErr: true}, "Error_when_ending_session": {username: "es_error@example.com", wantErr: true}, @@ -705,8 +667,7 @@ func TestEndSession(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -719,9 +680,6 @@ func TestEndSession(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - esReq := &authd.ESRequest{ SessionId: tc.sessionID, } @@ -759,10 +717,9 @@ func initBrokers() (brokerConfigPath string, cleanup func(), err error) { }, nil } -// newPAMClient returns a new GRPC PAM client for tests connected to brokerManager with the given database and -// permissionmanager. +// newPAMClient returns a new GRPC PAM client for tests connected to brokerManager with the given database. // If the one passed is nil, this function will create the database and close it upon test teardown. -func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager, pm *permissions.Manager) (client authd.PAMClient) { +func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager) (client authd.PAMClient) { t.Helper() // socket path is limited in length. @@ -780,9 +737,9 @@ func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager t.Cleanup(func() { _ = m.Stop() }) } - service := pam.NewService(context.Background(), m, brokerManager, pm) + service := pam.NewService(context.Background(), m, brokerManager) - grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(enableCheckGlobalAccess(service), errmessages.RedactErrorInterceptor)) + grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)) authd.RegisterPAMServer(grpcServer, service) done := make(chan struct{}) go func() { @@ -802,29 +759,6 @@ func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager return authd.NewPAMClient(conn) } -// newPermissionManager factors out permission manager creation for tests. -// this permission manager can then be tweaked for mimicking currentUser considered as root not. -func newPermissionManager(t *testing.T, currentUserNotRoot bool) permissions.Manager { - t.Helper() - - var opts = []permissions.Option{} - if !currentUserNotRoot { - opts = append(opts, permissions.Z_ForTests_WithCurrentUserAsRoot()) - } - return permissions.New(opts...) -} - -// enableCheckGlobalAccess returns the middleware hooking up in CheckGlobalAccess for the given service. -func enableCheckGlobalAccess(s pam.Service) grpc.UnaryServerInterceptor { - return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if err := s.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, err - } - - return handler(ctx, req) - } -} - // getMockBrokerGeneratedID returns the generated ID for the mock broker. func getMockBrokerGeneratedID(brokerManager *brokers.Manager) (string, error) { for _, b := range brokerManager.AvailableBrokers() { diff --git a/internal/services/pam/permissions.go b/internal/services/pam/permissions.go deleted file mode 100644 index 47d4347b7a..0000000000 --- a/internal/services/pam/permissions.go +++ /dev/null @@ -1,8 +0,0 @@ -package pam - -import "context" - -// CheckGlobalAccess denies all requests not coming from the root user. -func (s Service) CheckGlobalAccess(ctx context.Context, method string) error { - return s.permissionManager.CheckRequestIsFromRoot(ctx) -} diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated deleted file mode 100644 index 827eb715d3..0000000000 --- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated +++ /dev/null @@ -1,4 +0,0 @@ -FIRST CALL: - access: - msg: - err: only root can perform this operation diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db deleted file mode 100644 index 0cbb6c1eee..0000000000 --- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db +++ /dev/null @@ -1,4 +0,0 @@ -users: [] -groups: [] -users_to_groups: [] -schema_version: 3 diff --git a/internal/services/permissions.go b/internal/services/permissions.go deleted file mode 100644 index 1c43c232e5..0000000000 --- a/internal/services/permissions.go +++ /dev/null @@ -1,24 +0,0 @@ -package services - -import ( - "context" - "strings" - - "google.golang.org/grpc" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" -) - -func (m Manager) globalPermissions(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if strings.HasPrefix(info.FullMethod, "/authd.PAM/") { - if err := m.pamService.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, status.Error(codes.PermissionDenied, err.Error()) - } - } else if strings.HasPrefix(info.FullMethod, "/authd.NSS/") { - if err := m.userService.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, status.Error(codes.PermissionDenied, err.Error()) - } - } - - return handler(ctx, req) -} diff --git a/internal/services/permissions/testutils.go b/internal/services/permissions/testutils.go index 742d5505ec..340243f58a 100644 --- a/internal/services/permissions/testutils.go +++ b/internal/services/permissions/testutils.go @@ -40,20 +40,6 @@ func currentUserUID() uint32 { return uint32(uid) } -// Z_ForTests_SetCurrentUserAsRoot mutates a default permission to the current user's UID if currentUserAsRoot is true. -// -// nolint:revive,nolintlint // We want to use underscores in the function name here. -func Z_ForTests_SetCurrentUserAsRoot(m *Manager, currentUserAsRoot bool) { - testsdetection.MustBeTesting() - - if !currentUserAsRoot { - m.rootUID = defaultOptions.rootUID - return - } - - m.rootUID = currentUserUID() -} - // Z_ForTests_IdempotentPermissionError strips the UID from gRPC peer credential // messages (format: "uid: , pid: ") to make test output deterministic // regardless of which user runs the tests. diff --git a/internal/services/user/permissions.go b/internal/services/user/permissions.go deleted file mode 100644 index 5d04a9d341..0000000000 --- a/internal/services/user/permissions.go +++ /dev/null @@ -1,10 +0,0 @@ -package user - -import ( - "context" -) - -// CheckGlobalAccess always return access, then individual calls are filtered. -func (s Service) CheckGlobalAccess(ctx context.Context, method string) error { - return nil -} diff --git a/internal/services/user/user_test.go b/internal/services/user/user_test.go index 18667cce92..64b70dd950 100644 --- a/internal/services/user/user_test.go +++ b/internal/services/user/user_test.go @@ -620,7 +620,7 @@ func newUserServiceClient(t *testing.T, dbFile string, currentUserNotRoot ...boo } service := user.NewService(context.Background(), userManager, brokerManager, &permissionsManager) - grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(enableCheckGlobalAccess(service), errmessages.RedactErrorInterceptor)) + grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)) authd.RegisterUserServiceServer(grpcServer, service) done := make(chan struct{}) go func() { @@ -640,16 +640,6 @@ func newUserServiceClient(t *testing.T, dbFile string, currentUserNotRoot ...boo return authd.NewUserServiceClient(conn), userManager } -func enableCheckGlobalAccess(s user.Service) grpc.UnaryServerInterceptor { - return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if err := s.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, err - } - - return handler(ctx, req) - } -} - // newUserManagerForTests returns a user manager object cleaned up with the test ends. func newUserManagerForTests(t *testing.T, dbFile string) *users.Manager { t.Helper() diff --git a/pam/integration-tests/cli_test.go b/pam/integration-tests/cli_test.go index 9b6baf5bf1..1d688c55da 100644 --- a/pam/integration-tests/cli_test.go +++ b/pam/integration-tests/cli_test.go @@ -36,7 +36,6 @@ func TestCLIAuthenticate(t *testing.T) { username string // typed at the Username: prompt (empty = use pamUser as preset) clientOptions clientOptions - currentUserNotRoot bool wantLocalGroups bool expectedExitCode int extraArgs []string @@ -557,14 +556,6 @@ func TestCLIAuthenticate(t *testing.T) { }, }, - "Deny_authentication_if_current_user_is_not_considered_as_root": { - currentUserNotRoot: true, - expectedExitCode: 0, - test: func(t *testing.T, c *ptytest.Console) { - t.Helper() - cliWaitForResult(t, c) - }, - }, "Deny_authentication_if_max_attempts_reached": { username: "user-integration-max-attempts@example.com", expectedExitCode: 0, @@ -702,7 +693,7 @@ func TestCLIAuthenticate(t *testing.T) { var socketPath, groupFileOutput string var cancelAuthd func() - if tc.wantLocalGroups || tc.currentUserNotRoot || tc.useCancelableAuthd { + if tc.wantLocalGroups || tc.useCancelableAuthd { var groupFile string groupFileOutput, groupFile = prepareGroupFiles(t) @@ -713,9 +704,7 @@ func TestCLIAuthenticate(t *testing.T) { args := []testutils.DaemonOption{ testutils.WithGroupFile(groupFile), testutils.WithGroupFileOutput(groupFileOutput), - } - if !tc.currentUserNotRoot { - args = append(args, testutils.WithCurrentUserAsRoot) + testutils.WithCurrentUserAsRoot, } if tc.useCancelableAuthd { @@ -905,8 +894,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliEnv := preparePamRunnerTest(t, clientPath) tests := map[string]struct { - username string - currentUserNotRoot bool + username string test func(t *testing.T, socketPath, username string) string }{ @@ -1138,16 +1126,6 @@ func TestCLIChangeAuthTok(t *testing.T) { return ptySanitizeSnapshots(t, c) }, }, - "Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate": { - currentUserNotRoot: true, - test: func(t *testing.T, socketPath, username string) string { - t.Helper() - c := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionPasswd, cliEnv, clientOptions{}) - cliWaitForResult(t, c) - c.RequireSuccessfulExit(t) - return ptySanitizeSnapshots(t, c) - }, - }, "Exit_authd_if_local_broker_is_selected": { test: func(t *testing.T, socketPath, username string) string { t.Helper() @@ -1197,19 +1175,14 @@ func TestCLIChangeAuthTok(t *testing.T) { if err := os.WriteFile(groupFile, nil, 0o600); err != nil { t.Fatalf("Setup: could not create group file: %v", err) } - var socketPath string - if tc.currentUserNotRoot { - socketPath = runAuthd(t, testutils.WithGroupFile(groupFile)) - } else { - socketPath = runAuthd(t, - testutils.WithCurrentUserAsRoot, - testutils.WithGroupFile(groupFile), - testutils.WithGroupFileOutput(groupFile), - ) - } + socketPath := runAuthd(t, + testutils.WithCurrentUserAsRoot, + testutils.WithGroupFile(groupFile), + testutils.WithGroupFileOutput(groupFile), + ) username := tc.username - if username == "" && !tc.currentUserNotRoot { + if username == "" { username = testUserName(t, "cli-passwd") } diff --git a/pam/integration-tests/native_test.go b/pam/integration-tests/native_test.go index e912ce6202..4eb126d094 100644 --- a/pam/integration-tests/native_test.go +++ b/pam/integration-tests/native_test.go @@ -2,7 +2,6 @@ package main_test import ( "fmt" - "path/filepath" "regexp" "strings" "testing" @@ -86,7 +85,6 @@ func TestNativeAuthenticate(t *testing.T) { username string clientOptions clientOptions - currentUserNotRoot bool wantLocalGroups bool wantSeparateDaemon bool skipRunnerCheck bool @@ -540,11 +538,6 @@ func TestNativeAuthenticate(t *testing.T) { test: func(t *testing.T, c *ptytest.Console) { t.Helper(); nativeWaitForResult(t, c) }, expectedUser: "root", }, - "Deny_authentication_if_current_user_is_not_considered_as_root": { - currentUserNotRoot: true, - test: func(t *testing.T, c *ptytest.Console) { t.Helper(); nativeWaitForResult(t, c) }, - expectedUser: testUserName(t, "native"), - }, "Deny_authentication_if_max_attempts_reached": { test: func(t *testing.T, c *ptytest.Console) { t.Helper() @@ -698,20 +691,17 @@ func TestNativeAuthenticate(t *testing.T) { testutils.WithGroupFileOutput(groupFileOutput), ) t.Cleanup(authdCancel) - case tc.wantLocalGroups || tc.currentUserNotRoot: + case tc.wantLocalGroups: var groupFile string groupFileOutput, groupFile = prepareGroupFiles(t) if tc.wantLocalGroups { groupFileOutput = groupFile } - args := []testutils.DaemonOption{ + socketPath = runAuthd(t, + testutils.WithCurrentUserAsRoot, testutils.WithGroupFile(groupFile), testutils.WithGroupFileOutput(groupFileOutput), - } - if !tc.currentUserNotRoot { - args = append(args, testutils.WithCurrentUserAsRoot) - } - socketPath = runAuthd(t, args...) + ) default: socketPath, groupFileOutput = sharedAuthd(t) } @@ -798,11 +788,10 @@ func TestNativeChangeAuthTok(t *testing.T) { tests := map[string]struct { username string - clientOptions clientOptions - currentUserNotRoot bool - skipRunnerCheck bool - expectedUser string - expectedExitCode int + clientOptions clientOptions + skipRunnerCheck bool + expectedUser string + expectedExitCode int test func(t *testing.T, c *ptytest.Console) testWithSignals func(t *testing.T, c *ptytest.Console, signalFn func(username string)) @@ -953,13 +942,6 @@ func TestNativeChangeAuthTok(t *testing.T) { nativeWaitForChangeAuthTokResult(t, c) }, }, - "Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate": { - currentUserNotRoot: true, - test: func(t *testing.T, c *ptytest.Console) { - t.Helper() - nativeWaitForChangeAuthTokResult(t, c) - }, - }, "Exit_authd_if_local_broker_is_selected": { test: func(t *testing.T, c *ptytest.Console) { t.Helper() @@ -984,17 +966,12 @@ func TestNativeChangeAuthTok(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - var socketPath string - if tc.currentUserNotRoot { - socketPath = runAuthd(t, testutils.WithGroupFile(filepath.Join(t.TempDir(), "group"))) - } else { - socketPath, _ = sharedAuthd(t) - } + socketPath, _ := sharedAuthd(t) clientOptions := tc.clientOptions username := tc.username expectedUser := tc.expectedUser - if clientOptions.PamUser == "" && username == "" && !tc.currentUserNotRoot { + if clientOptions.PamUser == "" && username == "" { username = testUserName(t, "native-passwd") } if expectedUser == "" { diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root deleted file mode 100644 index ab268aa9a4..0000000000 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root +++ /dev/null @@ -1,11 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM Authenticate() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch -──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate deleted file mode 100644 index 7b95989d89..0000000000 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate +++ /dev/null @@ -1,11 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM ChangeAuthTok() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch -──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root deleted file mode 100644 index 050be9b20d..0000000000 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root +++ /dev/null @@ -1,10 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM Authenticate() - User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate deleted file mode 100644 index f882dcf20d..0000000000 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate +++ /dev/null @@ -1,10 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM ChangeAuthTok() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch From 5ba86134d0d5832c156339b5dd32ce7347517deb Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Tue, 30 Jun 2026 22:08:02 +0200 Subject: [PATCH 2/8] brokers: track username per session in manager Expose UsernameFromSessionID on the broker Manager so callers can look up the username associated with an active session without going through broker internals. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/brokers/manager.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/internal/brokers/manager.go b/internal/brokers/manager.go index debd779c31..f49290375e 100644 --- a/internal/brokers/manager.go +++ b/internal/brokers/manager.go @@ -26,6 +26,7 @@ type Manager struct { usersToBrokerMu sync.RWMutex transactionsToBroker map[string]*Broker + sessionsToUsername map[string]string transactionsToBrokerMu sync.RWMutex cleanup func() @@ -112,6 +113,7 @@ func NewManager(ctx context.Context, brokersConfPath string, configuredBrokers [ usersToBroker: make(map[string]*Broker), transactionsToBroker: make(map[string]*Broker), + sessionsToUsername: make(map[string]string), cleanup: cleanup, }, nil @@ -180,6 +182,7 @@ func (m *Manager) NewSession(brokerID, username, lang, mode, providerID string) log.Debugf(context.Background(), "%s: New %s session for %q", sessionID, mode, username) m.transactionsToBroker[sessionID] = broker + m.sessionsToUsername[sessionID] = username return sessionID, encryptionKey, nil } @@ -197,12 +200,20 @@ func (m *Manager) EndSession(sessionID string) error { m.transactionsToBrokerMu.Lock() log.Debugf(context.Background(), "%s: End session %q", - sessionID, m.transactionsToBroker[sessionID].Name) + sessionID, b.Name) delete(m.transactionsToBroker, sessionID) + delete(m.sessionsToUsername, sessionID) m.transactionsToBrokerMu.Unlock() return nil } +// UsernameFromSessionID returns the username associated with the given session ID. +func (m *Manager) UsernameFromSessionID(sessionID string) string { + m.transactionsToBrokerMu.RLock() + defer m.transactionsToBrokerMu.RUnlock() + return m.sessionsToUsername[sessionID] +} + // BrokerExists returns true if the brokerID is known by the manager. func (m *Manager) BrokerExists(brokerID string) bool { _, exists := m.brokers[brokerID] From 98c2f87a7bb84b931adc8acb8ecbcd6d9467bb03 Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Tue, 30 Jun 2026 22:08:15 +0200 Subject: [PATCH 3/8] services/pam: delay response after repeated authentication failures MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Without the root-only restriction on the PAM gRPC socket, any local user can now call IsAuthenticated in a tight loop against another user's cached (offline) OIDC credentials. The OIDC broker hashes those credentials with argon2id, but the parameters yield ~26ms per attempt on modern hardware — far faster than pam_unix's enforced 2s fail delay. Track consecutive authentication failures per username in an in-memory counter. The first authFailDelayThreshold (3) denials are returned immediately, matching the leniency of pam_faillock's deny=3 default and giving users a couple of free retries for typos. From the fourth failure onward, the response is held for authFailDelay (2s) before returning, matching the delay pam_unix imposes via pam_fail_delay(). A successful authentication resets the counter for that user. The counter is keyed by username (not session ID) so it cannot be reset by starting a new session. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/services/pam/export_test.go | 6 ++ internal/services/pam/pam.go | 89 ++++++++++++++++++++++++++-- internal/services/pam/pam_test.go | 28 +++++++++ internal/testutils/broker.go | 4 ++ 4 files changed, 123 insertions(+), 4 deletions(-) create mode 100644 internal/services/pam/export_test.go diff --git a/internal/services/pam/export_test.go b/internal/services/pam/export_test.go new file mode 100644 index 0000000000..c59b4799d9 --- /dev/null +++ b/internal/services/pam/export_test.go @@ -0,0 +1,6 @@ +package pam + +const ( + AuthFailDelayThreshold = authFailDelayThreshold + AuthFailDelay = authFailDelay +) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 6c0fe8aba0..3f2eab37e1 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -8,6 +8,8 @@ import ( "fmt" "os/user" "strings" + "sync" + "time" "github.com/canonical/authd/internal/brokers" "github.com/canonical/authd/internal/brokers/auth" @@ -24,10 +26,73 @@ import ( var _ authd.PAMServer = Service{} +const ( + // authFailDelayThreshold is the number of consecutive authentication failures before + // a delay is imposed on subsequent attempts, to mitigate brute-force attacks. + authFailDelayThreshold = 3 + // authFailDelay is the delay imposed after authFailDelayThreshold consecutive failures. + authFailDelay = 2 * time.Second + // authFailResetWindow is the duration after the last failure before the failure count + // is automatically reset, to avoid penalizing users indefinitely. + authFailResetWindow = 15 * time.Minute + // authFailMaxTracked is the maximum number of distinct usernames tracked simultaneously + // to bound memory usage. + authFailMaxTracked = 10000 +) + +// authFailEntry holds the failure count and the time of the most recent failure for one user. +type authFailEntry struct { + count int + lastFail time.Time +} + +// authFailTracker counts consecutive per-user authentication failures and imposes +// a delay once the threshold is reached. +type authFailTracker struct { + mu sync.Mutex + entries map[string]*authFailEntry +} + +func newAuthFailTracker() *authFailTracker { + return &authFailTracker{entries: make(map[string]*authFailEntry)} +} + +// recordFailure increments the failure count for username and returns the new count. +// If the previous failure is older than authFailResetWindow the counter is reset first. +// When the tracker is at capacity new usernames are not added and 0 is returned. +func (t *authFailTracker) recordFailure(username string) int { + t.mu.Lock() + defer t.mu.Unlock() + e, ok := t.entries[username] + if ok && time.Since(e.lastFail) >= authFailResetWindow { + // Stale entry: treat as fresh start. + ok = false + } + if !ok { + if len(t.entries) >= authFailMaxTracked { + // At capacity; skip tracking to avoid unbounded memory growth. + return 0 + } + e = &authFailEntry{} + t.entries[username] = e + } + e.count++ + e.lastFail = time.Now() + return e.count +} + +// recordSuccess resets the failure count for username. +func (t *authFailTracker) recordSuccess(username string) { + t.mu.Lock() + defer t.mu.Unlock() + delete(t.entries, username) +} + // Service is the implementation of the PAM module service. type Service struct { - userManager *users.Manager - brokerManager *brokers.Manager + userManager *users.Manager + brokerManager *brokers.Manager + failedAuths *authFailTracker authd.UnimplementedPAMServer } @@ -37,8 +102,9 @@ func NewService(ctx context.Context, userManager *users.Manager, brokerManager * log.Debug(ctx, "Building new gRPC PAM service") return Service{ - userManager: userManager, - brokerManager: brokerManager, + userManager: userManager, + brokerManager: brokerManager, + failedAuths: newAuthFailTracker(), } } @@ -290,7 +356,20 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res log.Debugf(ctx, "%s: Authentication result: %s", sessionID, access) + username := s.brokerManager.UsernameFromSessionID(sessionID) + if access != auth.Granted { + if access == auth.Denied || access == auth.DeniedMaxTries { + if count := s.failedAuths.recordFailure(username); count > authFailDelayThreshold { + log.Debugf(ctx, "%s: Delaying response after %d consecutive authentication failures for %q", sessionID, count, username) + timer := time.NewTimer(authFailDelay) + select { + case <-timer.C: + case <-ctx.Done(): + timer.Stop() + } + } + } return &authd.IAResponse{ Access: access, Msg: data, @@ -354,6 +433,8 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res } } + s.failedAuths.recordSuccess(username) + return &authd.IAResponse{ Access: access, Msg: msg, diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 46329f61a2..664e4400b7 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -546,6 +546,34 @@ func TestIsAuthenticated(t *testing.T) { } } +func TestIsAuthenticated_FailDelay(t *testing.T) { + t.Parallel() + + client := newPamClient(t, nil, globalBrokerManager) + + sessionID := startSession(t, client, "ia_denied@example.com") + iaReq := &authd.IARequest{ + SessionId: sessionID, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + } + + // The first authFailDelayThreshold failures should not be delayed. + for i := range pam.AuthFailDelayThreshold { + start := time.Now() + _, err := client.IsAuthenticated(context.Background(), iaReq) + require.NoError(t, err, "IsAuthenticated should not return an error") + require.Less(t, time.Since(start), pam.AuthFailDelay, + "attempt %d of %d should not trigger the fail delay", i+1, pam.AuthFailDelayThreshold) + } + + // The next failure should be delayed. + start := time.Now() + _, err := client.IsAuthenticated(context.Background(), iaReq) + require.NoError(t, err, "IsAuthenticated should not return an error") + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "attempt after threshold should be delayed") +} + func TestIDGeneration(t *testing.T) { t.Parallel() usernamePrefix := t.Name() diff --git a/internal/testutils/broker.go b/internal/testutils/broker.go index f542923df4..eab7ef478e 100644 --- a/internal/testutils/broker.go +++ b/internal/testutils/broker.go @@ -302,6 +302,10 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a access = authDenied data = "" + case "ia_denied": + access = authDenied + data = `{"message": "access denied"}` + case "ia_retry_without_data": access = authRetry data = "" From 35dbe9b4c6b1150fb4eed0eb42abe186b8bad688 Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Wed, 1 Jul 2026 14:29:47 +0200 Subject: [PATCH 4/8] Make auth-fail brute-force parameters configurable via authd.yaml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The three security-policy knobs that govern the PAM brute-force mitigation were hardcoded constants. Operators may need to tune them to satisfy site-specific compliance requirements, so expose them in the authd.yaml config: auth_fail_delay_threshold – failures before a delay is imposed (default 3) auth_fail_delay – length of that delay (default 2s) auth_fail_reset_window – inactivity window before reset (default 15m) authFailMaxTracked is intentionally kept hardcoded: it is a memory- safety bound rather than a security-policy value, and exposing it creates a DoS surface with no meaningful benefit. The values are grouped in pam.Config / pam.DefaultConfig following the same pattern used by users.Config for UID/GID ranges. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- cmd/authd/daemon/daemon.go | 10 ++++- debian/authd-config/authd.yaml | 16 +++++++ internal/services/manager.go | 4 +- internal/services/manager_test.go | 7 +-- internal/services/pam/export_test.go | 7 +-- internal/services/pam/pam.go | 67 +++++++++++++++++----------- internal/services/pam/pam_test.go | 4 +- 7 files changed, 78 insertions(+), 37 deletions(-) diff --git a/cmd/authd/daemon/daemon.go b/cmd/authd/daemon/daemon.go index b4cd2a4655..a7aaed4c9a 100644 --- a/cmd/authd/daemon/daemon.go +++ b/cmd/authd/daemon/daemon.go @@ -10,6 +10,7 @@ import ( "github.com/canonical/authd/internal/daemon" "github.com/canonical/authd/internal/decorate" "github.com/canonical/authd/internal/services" + "github.com/canonical/authd/internal/services/pam" "github.com/canonical/authd/internal/users" "github.com/canonical/authd/log" "github.com/spf13/cobra" @@ -46,6 +47,7 @@ type daemonConfig struct { Verbosity int Paths systemPaths UsersConfig *users.Config `mapstructure:",squash" yaml:",inline"` + PAMConfig *pam.Config `mapstructure:",squash" yaml:",inline"` } type options struct { @@ -91,6 +93,7 @@ func New(args ...Option) *App { Socket: "", }, UsersConfig: &users.DefaultConfig, + PAMConfig: &pam.DefaultConfig, } // Install and unmarshall configuration @@ -152,7 +155,12 @@ func (a *App) serve(config daemonConfig) error { panic("Users config must be set! This is a programmer error.") } - m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig) + if config.PAMConfig == nil { + // This is an assert, since we assume that the daemonConfig on [New] is properly defined. + panic("PAM config must be set! This is a programmer error.") + } + + m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig, *config.PAMConfig) if err != nil { close(a.ready) return err diff --git a/debian/authd-config/authd.yaml b/debian/authd-config/authd.yaml index 42e127ef55..5a2c1d7bd4 100644 --- a/debian/authd-config/authd.yaml +++ b/debian/authd-config/authd.yaml @@ -22,3 +22,19 @@ #UID_MAX: 60000 #GID_MIN: 10000 #GID_MAX: 60000 + +## Brute-force mitigation settings for authentication failures. +## To disable brute-force mitigation entirely, set auth_fail_delay to 0. +## +## auth_fail_delay_threshold: number of consecutive failures for a single user +## before a delay is imposed on subsequent attempts. +#auth_fail_delay_threshold: 3 +## +## auth_fail_delay: duration of the delay imposed once the threshold is reached. +## Accepts durations like "2s", "500ms", "1m". +#auth_fail_delay: 2s +## +## auth_fail_reset_window: duration of inactivity after the last failure before +## the failure count is automatically reset. +## Accepts durations like "15m", "1h", "30s". +#auth_fail_reset_window: 15m diff --git a/internal/services/manager.go b/internal/services/manager.go index ffd363cefb..78f54a009d 100644 --- a/internal/services/manager.go +++ b/internal/services/manager.go @@ -27,7 +27,7 @@ type Manager struct { } // NewManager returns a new manager after creating all necessary items for our business logic. -func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBrokers []string, usersConfig users.Config) (m Manager, err error) { +func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBrokers []string, usersConfig users.Config, pamConfig pam.Config) (m Manager, err error) { log.Debug(ctx, "Building authd object") brokerManager, err := brokers.NewManager(ctx, brokersConfPath, configuredBrokers) @@ -43,7 +43,7 @@ func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBr permissionManager := permissions.New() userService := user.NewService(ctx, userManager, brokerManager, &permissionManager) - pamService := pam.NewService(ctx, userManager, brokerManager, &permissionManager) + pamService := pam.NewService(ctx, userManager, brokerManager, &permissionManager, pamConfig) return Manager{ userManager: userManager, diff --git a/internal/services/manager_test.go b/internal/services/manager_test.go index d155fc014d..4552e39e82 100644 --- a/internal/services/manager_test.go +++ b/internal/services/manager_test.go @@ -13,6 +13,7 @@ import ( "github.com/canonical/authd/internal/proto/authd" "github.com/canonical/authd/internal/services" "github.com/canonical/authd/internal/services/errmessages" + "github.com/canonical/authd/internal/services/pam" "github.com/canonical/authd/internal/testutils" "github.com/canonical/authd/internal/testutils/golden" "github.com/canonical/authd/internal/users" @@ -43,7 +44,7 @@ func TestNewManager(t *testing.T) { t.Setenv("DBUS_SYSTEM_BUS_ADDRESS", tc.systemBusSocket) } - m, err := services.NewManager(context.Background(), tc.dbDir, t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), tc.dbDir, t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) if tc.wantErr { require.Error(t, err, "NewManager should have returned an error, but did not") return @@ -58,7 +59,7 @@ func TestNewManager(t *testing.T) { func TestRegisterGRPCServices(t *testing.T) { t.Parallel() - m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) require.NoError(t, err, "Setup: could not create manager for the test") defer require.NoError(t, m.Stop(), "Teardown: Stop should not have returned an error, but did") @@ -75,7 +76,7 @@ func TestRegisterGRPCServices(t *testing.T) { func TestAccessAuthorization(t *testing.T) { t.Parallel() - m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) require.NoError(t, err, "Setup: could not create manager for the test") defer require.NoError(t, m.Stop(), "Teardown: Stop should not have returned an error, but did") diff --git a/internal/services/pam/export_test.go b/internal/services/pam/export_test.go index c59b4799d9..08207e5758 100644 --- a/internal/services/pam/export_test.go +++ b/internal/services/pam/export_test.go @@ -1,6 +1,7 @@ package pam -const ( - AuthFailDelayThreshold = authFailDelayThreshold - AuthFailDelay = authFailDelay +// Re-export DefaultConfig fields for use in tests. +var ( + AuthFailDelayThreshold = DefaultConfig.AuthFailDelayThreshold + AuthFailDelay = DefaultConfig.AuthFailDelay ) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 3f2eab37e1..672087d94a 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -26,19 +26,28 @@ import ( var _ authd.PAMServer = Service{} -const ( - // authFailDelayThreshold is the number of consecutive authentication failures before +// authFailMaxTracked is the maximum number of distinct usernames tracked simultaneously +// to bound memory usage. +var authFailMaxTracked = 10000 + +// Config holds the configurable parameters for the PAM service. +type Config struct { + // AuthFailDelayThreshold is the number of consecutive authentication failures before // a delay is imposed on subsequent attempts, to mitigate brute-force attacks. - authFailDelayThreshold = 3 - // authFailDelay is the delay imposed after authFailDelayThreshold consecutive failures. - authFailDelay = 2 * time.Second - // authFailResetWindow is the duration after the last failure before the failure count + AuthFailDelayThreshold int `mapstructure:"auth_fail_delay_threshold" yaml:"auth_fail_delay_threshold"` + // AuthFailDelay is the delay imposed after AuthFailDelayThreshold consecutive failures. + AuthFailDelay time.Duration `mapstructure:"auth_fail_delay" yaml:"auth_fail_delay"` + // AuthFailResetWindow is the duration after the last failure before the failure count // is automatically reset, to avoid penalizing users indefinitely. - authFailResetWindow = 15 * time.Minute - // authFailMaxTracked is the maximum number of distinct usernames tracked simultaneously - // to bound memory usage. - authFailMaxTracked = 10000 -) + AuthFailResetWindow time.Duration `mapstructure:"auth_fail_reset_window" yaml:"auth_fail_reset_window"` +} + +// DefaultConfig is the default configuration for the PAM service. +var DefaultConfig = Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: 2 * time.Second, + AuthFailResetWindow: 15 * time.Minute, +} // authFailEntry holds the failure count and the time of the most recent failure for one user. type authFailEntry struct { @@ -49,22 +58,26 @@ type authFailEntry struct { // authFailTracker counts consecutive per-user authentication failures and imposes // a delay once the threshold is reached. type authFailTracker struct { - mu sync.Mutex - entries map[string]*authFailEntry + mu sync.Mutex + entries map[string]*authFailEntry + resetWindow time.Duration } -func newAuthFailTracker() *authFailTracker { - return &authFailTracker{entries: make(map[string]*authFailEntry)} +func newAuthFailTracker(cfg Config) *authFailTracker { + return &authFailTracker{ + entries: make(map[string]*authFailEntry), + resetWindow: cfg.AuthFailResetWindow, + } } // recordFailure increments the failure count for username and returns the new count. -// If the previous failure is older than authFailResetWindow the counter is reset first. +// If the previous failure is older than resetWindow the counter is reset first. // When the tracker is at capacity new usernames are not added and 0 is returned. func (t *authFailTracker) recordFailure(username string) int { t.mu.Lock() defer t.mu.Unlock() e, ok := t.entries[username] - if ok && time.Since(e.lastFail) >= authFailResetWindow { + if ok && time.Since(e.lastFail) >= t.resetWindow { // Stale entry: treat as fresh start. ok = false } @@ -90,21 +103,23 @@ func (t *authFailTracker) recordSuccess(username string) { // Service is the implementation of the PAM module service. type Service struct { - userManager *users.Manager - brokerManager *brokers.Manager - failedAuths *authFailTracker + userManager *users.Manager + brokerManager *brokers.Manager + failedAuths *authFailTracker + authFailConfig Config authd.UnimplementedPAMServer } // NewService returns a new PAM GRPC service. -func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager) Service { +func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager, cfg Config) Service { log.Debug(ctx, "Building new gRPC PAM service") return Service{ - userManager: userManager, - brokerManager: brokerManager, - failedAuths: newAuthFailTracker(), + userManager: userManager, + brokerManager: brokerManager, + failedAuths: newAuthFailTracker(cfg), + authFailConfig: cfg, } } @@ -360,9 +375,9 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res if access != auth.Granted { if access == auth.Denied || access == auth.DeniedMaxTries { - if count := s.failedAuths.recordFailure(username); count > authFailDelayThreshold { + if count := s.failedAuths.recordFailure(username); count > s.authFailConfig.AuthFailDelayThreshold { log.Debugf(ctx, "%s: Delaying response after %d consecutive authentication failures for %q", sessionID, count, username) - timer := time.NewTimer(authFailDelay) + timer := time.NewTimer(s.authFailConfig.AuthFailDelay) select { case <-timer.C: case <-ctx.Done(): diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 664e4400b7..89f12b3c53 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -73,7 +73,7 @@ func TestNewService(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, t.TempDir()) require.NoError(t, err, "Setup: could not create user manager") - service := pam.NewService(context.Background(), m, globalBrokerManager) + service := pam.NewService(context.Background(), m, globalBrokerManager, pam.DefaultConfig) brokers, err := service.AvailableBrokers(context.Background(), &authd.Empty{}) require.NoError(t, err, "can’t create the service directly") @@ -765,7 +765,7 @@ func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager t.Cleanup(func() { _ = m.Stop() }) } - service := pam.NewService(context.Background(), m, brokerManager) + service := pam.NewService(context.Background(), m, brokerManager, pam.DefaultConfig) grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)) authd.RegisterPAMServer(grpcServer, service) From 6021a235157affa0abd4d686fc60566e61f3313c Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Wed, 1 Jul 2026 15:37:40 +0200 Subject: [PATCH 5/8] Fail-secure when auth-fail tracker is at capacity Previously recordFailure returned 0 when the tracker was full, meaning the delay was never applied. An attacker could exploit this by flooding the tracker with bogus usernames (a fill attack) to disable brute-force protection for the real target. Return math.MaxInt instead so the delay is always applied regardless of whether the username could be recorded. This means the fill attack degrades to 'everyone gets delayed' rather than 'no one does'. Add TestIsAuthenticated_FailDelayTrackerFull to verify the fail-secure behaviour: fill the tracker to capacity with one username, then confirm the delay is still applied for a new username that cannot be tracked. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/services/pam/export_test.go | 3 +++ internal/services/pam/pam.go | 11 ++++++--- internal/services/pam/pam_test.go | 34 ++++++++++++++++++++++++++++ internal/testutils/broker.go | 2 +- 4 files changed, 46 insertions(+), 4 deletions(-) diff --git a/internal/services/pam/export_test.go b/internal/services/pam/export_test.go index 08207e5758..e6202f4b35 100644 --- a/internal/services/pam/export_test.go +++ b/internal/services/pam/export_test.go @@ -4,4 +4,7 @@ package pam var ( AuthFailDelayThreshold = DefaultConfig.AuthFailDelayThreshold AuthFailDelay = DefaultConfig.AuthFailDelay + + // AuthFailMaxTracked allows tests to override the tracker capacity. + AuthFailMaxTracked = &authFailMaxTracked ) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 672087d94a..684e8d57eb 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -6,6 +6,7 @@ import ( "encoding/json" "errors" "fmt" + "math" "os/user" "strings" "sync" @@ -72,7 +73,8 @@ func newAuthFailTracker(cfg Config) *authFailTracker { // recordFailure increments the failure count for username and returns the new count. // If the previous failure is older than resetWindow the counter is reset first. -// When the tracker is at capacity new usernames are not added and 0 is returned. +// When the tracker is at capacity the username is not stored, but math.MaxInt is +// returned so that the delay is still applied (fail-secure). func (t *authFailTracker) recordFailure(username string) int { t.mu.Lock() defer t.mu.Unlock() @@ -83,8 +85,11 @@ func (t *authFailTracker) recordFailure(username string) int { } if !ok { if len(t.entries) >= authFailMaxTracked { - // At capacity; skip tracking to avoid unbounded memory growth. - return 0 + // At capacity: return a count that always exceeds the threshold so + // the delay is applied. This prevents a fill attack (flooding the + // tracker with bogus usernames) from disabling brute-force protection + // for the real target. + return math.MaxInt } e = &authFailEntry{} t.entries[username] = e diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 89f12b3c53..1b1fd01d03 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -574,6 +574,40 @@ func TestIsAuthenticated_FailDelay(t *testing.T) { "attempt after threshold should be delayed") } +func TestIsAuthenticated_FailDelayTrackerFull(t *testing.T) { + // Cannot be parallel: temporarily overrides the package-level authFailMaxTracked. + //nolint:paralleltest // modifies package-level authFailMaxTracked, cannot run in parallel + + // Use a tracker that can only hold a single entry so we can fill it with + // one bogus username and then verify the delay is still applied to a + // second, previously unseen username (fail-secure behaviour). + orig := *pam.AuthFailMaxTracked + *pam.AuthFailMaxTracked = 1 + t.Cleanup(func() { *pam.AuthFailMaxTracked = orig }) + + client := newPamClient(t, nil, globalBrokerManager) + + // Fill the tracker with a bogus username. + bogusSession := startSession(t, client, "ia_denied@example.com") + _, _ = client.IsAuthenticated(context.Background(), &authd.IARequest{ + SessionId: bogusSession, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + }) + + // A different user's first failure should still be delayed even though the + // tracker is full (fill-attack protection). + targetSession := startSession(t, client, "ia_denied_second@example.com") + iaReq := &authd.IARequest{ + SessionId: targetSession, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + } + + start := time.Now() + _, _ = client.IsAuthenticated(context.Background(), iaReq) + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "first failure for new user should be delayed when tracker is full") +} + func TestIDGeneration(t *testing.T) { t.Parallel() usernamePrefix := t.Name() diff --git a/internal/testutils/broker.go b/internal/testutils/broker.go index eab7ef478e..ca0c79b5ba 100644 --- a/internal/testutils/broker.go +++ b/internal/testutils/broker.go @@ -302,7 +302,7 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a access = authDenied data = "" - case "ia_denied": + case "ia_denied", "ia_denied_second": access = authDenied data = `{"message": "access denied"}` From 8183406b84a2b96e5a5490ec1187a635f90af35b Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Wed, 1 Jul 2026 18:19:48 +0200 Subject: [PATCH 6/8] Persist PAM broker choice during authentication Non-root PAM consumers can no longer make the follow-up SetBroker RPC after the root-only peer check, which left successful logins unable to remember their selected broker. authd already knows the authenticated user and session broker inside IsAuthenticated, so persisting the default broker there avoids the extra privileged round-trip. Drop the unused SetBroker RPC and simplify the PAM client and test flows so AcctMgmt now consistently returns PAM_IGNORE while broker persistence happens server-side. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/proto/authd/authd.pb.go | 358 ++++++++---------- internal/proto/authd/authd.proto | 5 - internal/proto/authd/authd_grpc.pb.go | 42 +- internal/services/manager.go | 2 +- internal/services/pam/pam.go | 46 +-- internal/services/pam/pam_test.go | 58 --- .../testdata/golden/TestRegisterGRPCServices | 3 - pam/integration-tests/cli_test.go | 42 +- pam/integration-tests/gdm_test.go | 35 +- pam/integration-tests/helpers_test.go | 3 - pam/integration-tests/native_test.go | 8 +- pam/integration-tests/ssh_test.go | 9 +- ...uthenticate_user_and_add_it_to_local_group | 3 - ...Authenticate_user_and_offer_password_reset | 3 - ..._and_reset_password_while_enforcing_policy | 3 - ...sword_with_case_insensitive_user_selection | 9 - .../Authenticate_user_successfully | 3 - ..._user_successfully_after_trying_empty_user | 3 - ...ccessfully_with_invalid_connection_timeout | 3 - ...sfully_with_password_only_supported_method | 3 - ...nticate_user_successfully_with_preset_user | 3 - ...enticate_user_successfully_with_upper_case | 3 - ...r_successfully_with_upper_case_preset_user | 3 - .../Authenticate_user_switching_auth_mode | 3 - ...uthenticate_user_switching_to_local_broker | 4 - .../Authenticate_user_switching_username | 3 - ...thenticate_user_with_form_mode_with_button | 3 - .../Authenticate_user_with_mfa | 3 - ..._and_reset_password_while_enforcing_policy | 3 - .../Authenticate_user_with_qr_code | 3 - ...user_with_qr_code_after_many_regenerations | 3 - .../Authenticate_user_with_qr_code_in_a_TTY | 3 - ...nticate_user_with_qr_code_in_a_TTY_session | 3 - .../Authenticate_user_with_qr_code_in_screen | 3 - ...ate_with_warnings_on_unsupported_arguments | 3 - .../Autoselect_local_broker_for_local_user | 4 - ...oselect_local_broker_for_local_user_preset | 4 - ...eny_authentication_if_max_attempts_reached | 5 - ...wpassword_does_not_match_required_criteria | 3 - ...Deny_authentication_if_user_does_not_exist | 5 - .../Error_if_cannot_connect_to_authd | 5 - .../Exit_authd_if_local_broker_is_selected | 4 - .../Exit_authd_if_user_presses_ctrl_d | 5 - .../Exit_authd_if_user_sigints | 5 - .../Exit_if_authd_is_stopped | 5 - .../Prevent_user_from_switching_username | 3 - .../Remember_last_successful_broker_and_mode | 6 - .../Change_passwd_after_MFA_auth | 3 - ...successfully_and_authenticate_with_new_one | 6 - ...henticate_with_new_one_with_different_case | 6 - .../Exit_authd_if_local_broker_is_selected | 4 - .../Exit_authd_if_user_presses_ctrl_d | 5 - .../Exit_authd_if_user_sigints | 5 - .../Prevent_change_password_if_auth_fails | 5 - ...ent_change_password_if_user_does_not_exist | 5 - ...w_password_does_not_match_quality_criteria | 3 - ...etry_if_new_password_is_rejected_by_broker | 6 - .../Retry_if_new_password_is_same_of_previous | 3 - ...y_if_password_confirmation_is_not_the_same | 3 - ...uthenticate_user_and_accept_password_reset | 3 - ...uthenticate_user_and_add_it_to_local_group | 3 - ...Authenticate_user_and_offer_password_reset | 3 - ..._and_reset_password_while_enforcing_policy | 3 - ...sword_with_case_insensitive_user_selection | 9 - .../Authenticate_user_on_ssh_service | 3 - ...service_with_custom_name_and_auth_info_env | 3 - ...ervice_with_custom_name_and_connection_env | 3 - .../Authenticate_user_successfully | 3 - ...fully_using_upper_case_with_user_selection | 3 - ...ccessfully_with_invalid_connection_timeout | 3 - ...sfully_with_password_only_supported_method | 3 - ...h_password_only_supported_method_in_polkit | 3 - ...enticate_user_successfully_with_upper_case | 3 - ...cate_user_successfully_with_user_selection | 3 - .../Authenticate_user_switching_auth_mode | 3 - ...uthenticate_user_switching_to_local_broker | 4 - .../Authenticate_user_switching_username | 3 - ...thenticate_user_with_form_mode_with_button | 3 - ..._user_with_form_mode_with_button_in_polkit | 3 - ...orm_mode_with_button_two_supported_methods | 3 - .../Authenticate_user_with_mfa | 3 - ..._and_reset_password_while_enforcing_policy | 3 - ...cate_user_with_mfa_and_reset_same_password | 3 - .../Authenticate_user_with_qr_code | 3 - .../Authenticate_user_with_qr_code_in_a_TTY | 3 - ...nticate_user_with_qr_code_in_a_TTY_session | 3 - .../Authenticate_user_with_qr_code_in_screen | 3 - .../Authenticate_user_with_qr_code_in_ssh | 3 - ...uthenticate_user_with_qr_code_without_code | 3 - ...ate_with_warnings_on_unsupported_arguments | 3 - .../Autoselect_local_broker_for_local_user | 4 - ...lect_local_broker_for_local_user_on_polkit | 4 - ...oselect_local_broker_for_local_user_preset | 4 - ...cal_broker_for_local_user_preset_on_polkit | 4 - ...eny_authentication_if_max_attempts_reached | 5 - ...wpassword_does_not_match_required_criteria | 3 - ...Deny_authentication_if_user_does_not_exist | 5 - ...user_does_not_exist_and_matches_cancel_key | 5 - .../Error_if_cannot_connect_to_authd | 5 - .../Exit_authd_if_local_broker_is_selected | 4 - .../Exit_if_authd_is_stopped | 5 - ...d_on_custom_ssh_service_with_auth_info_env | 4 - ..._on_custom_ssh_service_with_connection_env | 4 - ..._if_user_is_not_pre-checked_on_ssh_service | 4 - ...revent_preset_user_from_switching_username | 3 - .../Remember_last_successful_broker_and_mode | 6 - .../Change_passwd_after_MFA_auth | 3 - ...successfully_and_authenticate_with_new_one | 6 - ...henticate_with_new_one_with_different_case | 6 - ..._broker_and_password_only_supported_method | 6 - .../Exit_authd_if_local_broker_is_selected | 4 - .../Prevent_change_password_if_auth_fails | 5 - ...ent_change_password_if_user_does_not_exist | 5 - ...w_password_does_not_match_quality_criteria | 3 - ...etry_if_new_password_is_rejected_by_broker | 3 - .../Retry_if_new_password_is_same_of_previous | 3 - ...y_if_password_confirmation_is_not_the_same | 3 - ...uthenticate_user_and_accept_password_reset | 1 - ...and_accept_password_reset_with_shared_sshd | 1 - ...uthenticate_user_and_add_it_to_local_group | 1 - ...and_add_it_to_local_group_with_shared_sshd | 1 - ...Authenticate_user_and_offer_password_reset | 1 - ..._and_offer_password_reset_with_shared_sshd | 1 - ...n_allow_uppercase_re-login_on_ubuntu_24.04 | 2 - ..._re-login_on_ubuntu_24.04_with_shared_sshd | 2 - ...en_deny_uppercase_re-login_on_ubuntu_26.04 | 1 - ..._re-login_on_ubuntu_26.04_with_shared_sshd | 1 - ..._and_reset_password_while_enforcing_policy | 1 - ...rd_while_enforcing_policy_with_shared_sshd | 1 - .../Authenticate_user_locks_and_unlocks_it | 2 - ...user_locks_and_unlocks_it_with_shared_sshd | 2 - .../Authenticate_user_successfully | 1 - ...nticate_user_successfully_and_enters_shell | 1 - ...essfully_and_enters_shell_with_shared_sshd | 1 - ...te_user_successfully_if_already_registered | 1 - ...lly_if_already_registered_with_shared_sshd | 1 - ...registered_with_upper_case_on_ubuntu_24.04 | 1 - ...pper_case_on_ubuntu_24.04_with_shared_sshd | 1 - ...nticate_user_successfully_with_shared_sshd | 1 - ...ccessfully_with_upper_case_on_ubuntu_24.04 | 1 - ...pper_case_on_ubuntu_24.04_with_shared_sshd | 1 - .../Authenticate_user_switching_auth_mode | 1 - ..._user_switching_auth_mode_with_shared_sshd | 1 - ...thenticate_user_with_form_mode_with_button | 1 - ...ith_form_mode_with_button_with_shared_sshd | 1 - .../Authenticate_user_with_mfa | 1 - ..._and_reset_password_while_enforcing_policy | 1 - ...rd_while_enforcing_policy_with_shared_sshd | 1 - ...cate_user_with_mfa_and_reset_same_password | 1 - ...a_and_reset_same_password_with_shared_sshd | 1 - ...uthenticate_user_with_mfa_with_shared_sshd | 1 - .../Authenticate_user_with_qr_code | 1 - ...nticate_user_with_qr_code_with_shared_sshd | 1 - ...wpassword_does_not_match_required_criteria | 1 - ...t_match_required_criteria_with_shared_sshd | 1 - .../Prevent_user_from_switching_username | 1 - ...r_from_switching_username_with_shared_sshd | 1 - .../Remember_last_successful_broker_and_mode | 2 - ...uccessful_broker_and_mode_with_shared_sshd | 2 - pam/internal/pam_test/pam-client-dummy.go | 29 -- .../pam_test/pam-client-dummy_test.go | 61 --- pam/internal/pam_test/runner-utils.go | 4 - pam/pam.go | 97 +---- pam/tools/pam-runner/pam-runner.go | 2 - 164 files changed, 208 insertions(+), 1044 deletions(-) diff --git a/internal/proto/authd/authd.pb.go b/internal/proto/authd/authd.pb.go index bb6f26a887..c92111a902 100644 --- a/internal/proto/authd/authd.pb.go +++ b/internal/proto/authd/authd.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.7 -// protoc v3.21.12 +// protoc-gen-go v1.36.10 +// protoc v6.33.1 // source: authd.proto package authd @@ -801,58 +801,6 @@ func (x *IAResponse) GetMsg() string { return "" } -type STBRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - BrokerId string `protobuf:"bytes,1,opt,name=broker_id,json=brokerId,proto3" json:"broker_id,omitempty"` - Username string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *STBRequest) Reset() { - *x = STBRequest{} - mi := &file_authd_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *STBRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*STBRequest) ProtoMessage() {} - -func (x *STBRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use STBRequest.ProtoReflect.Descriptor instead. -func (*STBRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{14} -} - -func (x *STBRequest) GetBrokerId() string { - if x != nil { - return x.BrokerId - } - return "" -} - -func (x *STBRequest) GetUsername() string { - if x != nil { - return x.Username - } - return "" -} - type ESRequest struct { state protoimpl.MessageState `protogen:"open.v1"` SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` @@ -862,7 +810,7 @@ type ESRequest struct { func (x *ESRequest) Reset() { *x = ESRequest{} - mi := &file_authd_proto_msgTypes[15] + mi := &file_authd_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -874,7 +822,7 @@ func (x *ESRequest) String() string { func (*ESRequest) ProtoMessage() {} func (x *ESRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[15] + mi := &file_authd_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -887,7 +835,7 @@ func (x *ESRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ESRequest.ProtoReflect.Descriptor instead. func (*ESRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{15} + return file_authd_proto_rawDescGZIP(), []int{14} } func (x *ESRequest) GetSessionId() string { @@ -907,7 +855,7 @@ type GetUserByNameRequest struct { func (x *GetUserByNameRequest) Reset() { *x = GetUserByNameRequest{} - mi := &file_authd_proto_msgTypes[16] + mi := &file_authd_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -919,7 +867,7 @@ func (x *GetUserByNameRequest) String() string { func (*GetUserByNameRequest) ProtoMessage() {} func (x *GetUserByNameRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[16] + mi := &file_authd_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -932,7 +880,7 @@ func (x *GetUserByNameRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetUserByNameRequest.ProtoReflect.Descriptor instead. func (*GetUserByNameRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{16} + return file_authd_proto_rawDescGZIP(), []int{15} } func (x *GetUserByNameRequest) GetName() string { @@ -958,7 +906,7 @@ type GetUserByIDRequest struct { func (x *GetUserByIDRequest) Reset() { *x = GetUserByIDRequest{} - mi := &file_authd_proto_msgTypes[17] + mi := &file_authd_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -970,7 +918,7 @@ func (x *GetUserByIDRequest) String() string { func (*GetUserByIDRequest) ProtoMessage() {} func (x *GetUserByIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[17] + mi := &file_authd_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -983,7 +931,7 @@ func (x *GetUserByIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetUserByIDRequest.ProtoReflect.Descriptor instead. func (*GetUserByIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{17} + return file_authd_proto_rawDescGZIP(), []int{16} } func (x *GetUserByIDRequest) GetId() uint32 { @@ -1002,7 +950,7 @@ type LockUserRequest struct { func (x *LockUserRequest) Reset() { *x = LockUserRequest{} - mi := &file_authd_proto_msgTypes[18] + mi := &file_authd_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1014,7 +962,7 @@ func (x *LockUserRequest) String() string { func (*LockUserRequest) ProtoMessage() {} func (x *LockUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[18] + mi := &file_authd_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1027,7 +975,7 @@ func (x *LockUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use LockUserRequest.ProtoReflect.Descriptor instead. func (*LockUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{18} + return file_authd_proto_rawDescGZIP(), []int{17} } func (x *LockUserRequest) GetName() string { @@ -1046,7 +994,7 @@ type UnlockUserRequest struct { func (x *UnlockUserRequest) Reset() { *x = UnlockUserRequest{} - mi := &file_authd_proto_msgTypes[19] + mi := &file_authd_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1058,7 +1006,7 @@ func (x *UnlockUserRequest) String() string { func (*UnlockUserRequest) ProtoMessage() {} func (x *UnlockUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[19] + mi := &file_authd_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1071,7 +1019,7 @@ func (x *UnlockUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UnlockUserRequest.ProtoReflect.Descriptor instead. func (*UnlockUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{19} + return file_authd_proto_rawDescGZIP(), []int{18} } func (x *UnlockUserRequest) GetName() string { @@ -1092,7 +1040,7 @@ type DeleteUserRequest struct { func (x *DeleteUserRequest) Reset() { *x = DeleteUserRequest{} - mi := &file_authd_proto_msgTypes[20] + mi := &file_authd_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1104,7 +1052,7 @@ func (x *DeleteUserRequest) String() string { func (*DeleteUserRequest) ProtoMessage() {} func (x *DeleteUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[20] + mi := &file_authd_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1117,7 +1065,7 @@ func (x *DeleteUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteUserRequest.ProtoReflect.Descriptor instead. func (*DeleteUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{20} + return file_authd_proto_rawDescGZIP(), []int{19} } func (x *DeleteUserRequest) GetName() string { @@ -1143,7 +1091,7 @@ type DeleteGroupRequest struct { func (x *DeleteGroupRequest) Reset() { *x = DeleteGroupRequest{} - mi := &file_authd_proto_msgTypes[21] + mi := &file_authd_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1155,7 +1103,7 @@ func (x *DeleteGroupRequest) String() string { func (*DeleteGroupRequest) ProtoMessage() {} func (x *DeleteGroupRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[21] + mi := &file_authd_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1168,7 +1116,7 @@ func (x *DeleteGroupRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteGroupRequest.ProtoReflect.Descriptor instead. func (*DeleteGroupRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{21} + return file_authd_proto_rawDescGZIP(), []int{20} } func (x *DeleteGroupRequest) GetName() string { @@ -1187,7 +1135,7 @@ type GetGroupByNameRequest struct { func (x *GetGroupByNameRequest) Reset() { *x = GetGroupByNameRequest{} - mi := &file_authd_proto_msgTypes[22] + mi := &file_authd_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1199,7 +1147,7 @@ func (x *GetGroupByNameRequest) String() string { func (*GetGroupByNameRequest) ProtoMessage() {} func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[22] + mi := &file_authd_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1212,7 +1160,7 @@ func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetGroupByNameRequest.ProtoReflect.Descriptor instead. func (*GetGroupByNameRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{22} + return file_authd_proto_rawDescGZIP(), []int{21} } func (x *GetGroupByNameRequest) GetName() string { @@ -1231,7 +1179,7 @@ type GetGroupByIDRequest struct { func (x *GetGroupByIDRequest) Reset() { *x = GetGroupByIDRequest{} - mi := &file_authd_proto_msgTypes[23] + mi := &file_authd_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1243,7 +1191,7 @@ func (x *GetGroupByIDRequest) String() string { func (*GetGroupByIDRequest) ProtoMessage() {} func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[23] + mi := &file_authd_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1256,7 +1204,7 @@ func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetGroupByIDRequest.ProtoReflect.Descriptor instead. func (*GetGroupByIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{23} + return file_authd_proto_rawDescGZIP(), []int{22} } func (x *GetGroupByIDRequest) GetId() uint32 { @@ -1279,7 +1227,7 @@ type SetUserIDRequest struct { func (x *SetUserIDRequest) Reset() { *x = SetUserIDRequest{} - mi := &file_authd_proto_msgTypes[24] + mi := &file_authd_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1291,7 +1239,7 @@ func (x *SetUserIDRequest) String() string { func (*SetUserIDRequest) ProtoMessage() {} func (x *SetUserIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[24] + mi := &file_authd_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1304,7 +1252,7 @@ func (x *SetUserIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetUserIDRequest.ProtoReflect.Descriptor instead. func (*SetUserIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{24} + return file_authd_proto_rawDescGZIP(), []int{23} } func (x *SetUserIDRequest) GetName() string { @@ -1339,7 +1287,7 @@ type SetUserIDResponse struct { func (x *SetUserIDResponse) Reset() { *x = SetUserIDResponse{} - mi := &file_authd_proto_msgTypes[25] + mi := &file_authd_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1351,7 +1299,7 @@ func (x *SetUserIDResponse) String() string { func (*SetUserIDResponse) ProtoMessage() {} func (x *SetUserIDResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[25] + mi := &file_authd_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1364,7 +1312,7 @@ func (x *SetUserIDResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetUserIDResponse.ProtoReflect.Descriptor instead. func (*SetUserIDResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{25} + return file_authd_proto_rawDescGZIP(), []int{24} } func (x *SetUserIDResponse) GetIdChanged() bool { @@ -1401,7 +1349,7 @@ type SetGroupIDRequest struct { func (x *SetGroupIDRequest) Reset() { *x = SetGroupIDRequest{} - mi := &file_authd_proto_msgTypes[26] + mi := &file_authd_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1413,7 +1361,7 @@ func (x *SetGroupIDRequest) String() string { func (*SetGroupIDRequest) ProtoMessage() {} func (x *SetGroupIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[26] + mi := &file_authd_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1426,7 +1374,7 @@ func (x *SetGroupIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetGroupIDRequest.ProtoReflect.Descriptor instead. func (*SetGroupIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{26} + return file_authd_proto_rawDescGZIP(), []int{25} } func (x *SetGroupIDRequest) GetName() string { @@ -1461,7 +1409,7 @@ type SetGroupIDResponse struct { func (x *SetGroupIDResponse) Reset() { *x = SetGroupIDResponse{} - mi := &file_authd_proto_msgTypes[27] + mi := &file_authd_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1473,7 +1421,7 @@ func (x *SetGroupIDResponse) String() string { func (*SetGroupIDResponse) ProtoMessage() {} func (x *SetGroupIDResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[27] + mi := &file_authd_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1486,7 +1434,7 @@ func (x *SetGroupIDResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetGroupIDResponse.ProtoReflect.Descriptor instead. func (*SetGroupIDResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{27} + return file_authd_proto_rawDescGZIP(), []int{26} } func (x *SetGroupIDResponse) GetIdChanged() bool { @@ -1520,7 +1468,7 @@ type SetShellRequest struct { func (x *SetShellRequest) Reset() { *x = SetShellRequest{} - mi := &file_authd_proto_msgTypes[28] + mi := &file_authd_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1532,7 +1480,7 @@ func (x *SetShellRequest) String() string { func (*SetShellRequest) ProtoMessage() {} func (x *SetShellRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[28] + mi := &file_authd_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1545,7 +1493,7 @@ func (x *SetShellRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetShellRequest.ProtoReflect.Descriptor instead. func (*SetShellRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{28} + return file_authd_proto_rawDescGZIP(), []int{27} } func (x *SetShellRequest) GetName() string { @@ -1571,7 +1519,7 @@ type SetShellResponse struct { func (x *SetShellResponse) Reset() { *x = SetShellResponse{} - mi := &file_authd_proto_msgTypes[29] + mi := &file_authd_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1583,7 +1531,7 @@ func (x *SetShellResponse) String() string { func (*SetShellResponse) ProtoMessage() {} func (x *SetShellResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[29] + mi := &file_authd_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1596,7 +1544,7 @@ func (x *SetShellResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetShellResponse.ProtoReflect.Descriptor instead. func (*SetShellResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{29} + return file_authd_proto_rawDescGZIP(), []int{28} } func (x *SetShellResponse) GetWarnings() []string { @@ -1616,7 +1564,7 @@ type SetHomeDirRequest struct { func (x *SetHomeDirRequest) Reset() { *x = SetHomeDirRequest{} - mi := &file_authd_proto_msgTypes[30] + mi := &file_authd_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1628,7 +1576,7 @@ func (x *SetHomeDirRequest) String() string { func (*SetHomeDirRequest) ProtoMessage() {} func (x *SetHomeDirRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[30] + mi := &file_authd_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1641,7 +1589,7 @@ func (x *SetHomeDirRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetHomeDirRequest.ProtoReflect.Descriptor instead. func (*SetHomeDirRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{30} + return file_authd_proto_rawDescGZIP(), []int{29} } func (x *SetHomeDirRequest) GetName() string { @@ -1669,7 +1617,7 @@ type SetHomeDirResponse struct { func (x *SetHomeDirResponse) Reset() { *x = SetHomeDirResponse{} - mi := &file_authd_proto_msgTypes[31] + mi := &file_authd_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1681,7 +1629,7 @@ func (x *SetHomeDirResponse) String() string { func (*SetHomeDirResponse) ProtoMessage() {} func (x *SetHomeDirResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[31] + mi := &file_authd_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1694,7 +1642,7 @@ func (x *SetHomeDirResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetHomeDirResponse.ProtoReflect.Descriptor instead. func (*SetHomeDirResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{31} + return file_authd_proto_rawDescGZIP(), []int{30} } func (x *SetHomeDirResponse) GetHomeDirChanged() bool { @@ -1727,7 +1675,7 @@ type DeleteUserResponse struct { func (x *DeleteUserResponse) Reset() { *x = DeleteUserResponse{} - mi := &file_authd_proto_msgTypes[32] + mi := &file_authd_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1739,7 +1687,7 @@ func (x *DeleteUserResponse) String() string { func (*DeleteUserResponse) ProtoMessage() {} func (x *DeleteUserResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[32] + mi := &file_authd_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1752,7 +1700,7 @@ func (x *DeleteUserResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteUserResponse.ProtoReflect.Descriptor instead. func (*DeleteUserResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{32} + return file_authd_proto_rawDescGZIP(), []int{31} } func (x *DeleteUserResponse) GetWarnings() []string { @@ -1776,7 +1724,7 @@ type User struct { func (x *User) Reset() { *x = User{} - mi := &file_authd_proto_msgTypes[33] + mi := &file_authd_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1788,7 +1736,7 @@ func (x *User) String() string { func (*User) ProtoMessage() {} func (x *User) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[33] + mi := &file_authd_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1801,7 +1749,7 @@ func (x *User) ProtoReflect() protoreflect.Message { // Deprecated: Use User.ProtoReflect.Descriptor instead. func (*User) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{33} + return file_authd_proto_rawDescGZIP(), []int{32} } func (x *User) GetName() string { @@ -1855,7 +1803,7 @@ type Users struct { func (x *Users) Reset() { *x = Users{} - mi := &file_authd_proto_msgTypes[34] + mi := &file_authd_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1867,7 +1815,7 @@ func (x *Users) String() string { func (*Users) ProtoMessage() {} func (x *Users) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[34] + mi := &file_authd_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1880,7 +1828,7 @@ func (x *Users) ProtoReflect() protoreflect.Message { // Deprecated: Use Users.ProtoReflect.Descriptor instead. func (*Users) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{34} + return file_authd_proto_rawDescGZIP(), []int{33} } func (x *Users) GetUsers() []*User { @@ -1903,7 +1851,7 @@ type Group struct { func (x *Group) Reset() { *x = Group{} - mi := &file_authd_proto_msgTypes[35] + mi := &file_authd_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1915,7 +1863,7 @@ func (x *Group) String() string { func (*Group) ProtoMessage() {} func (x *Group) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[35] + mi := &file_authd_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1928,7 +1876,7 @@ func (x *Group) ProtoReflect() protoreflect.Message { // Deprecated: Use Group.ProtoReflect.Descriptor instead. func (*Group) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{35} + return file_authd_proto_rawDescGZIP(), []int{34} } func (x *Group) GetName() string { @@ -1968,7 +1916,7 @@ type Groups struct { func (x *Groups) Reset() { *x = Groups{} - mi := &file_authd_proto_msgTypes[36] + mi := &file_authd_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1980,7 +1928,7 @@ func (x *Groups) String() string { func (*Groups) ProtoMessage() {} func (x *Groups) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[36] + mi := &file_authd_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1993,7 +1941,7 @@ func (x *Groups) ProtoReflect() protoreflect.Message { // Deprecated: Use Groups.ProtoReflect.Descriptor instead. func (*Groups) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{36} + return file_authd_proto_rawDescGZIP(), []int{35} } func (x *Groups) GetGroups() []*Group { @@ -2014,7 +1962,7 @@ type ABResponse_BrokerInfo struct { func (x *ABResponse_BrokerInfo) Reset() { *x = ABResponse_BrokerInfo{} - mi := &file_authd_proto_msgTypes[37] + mi := &file_authd_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2026,7 +1974,7 @@ func (x *ABResponse_BrokerInfo) String() string { func (*ABResponse_BrokerInfo) ProtoMessage() {} func (x *ABResponse_BrokerInfo) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[37] + mi := &file_authd_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2073,7 +2021,7 @@ type GAMResponse_AuthenticationMode struct { func (x *GAMResponse_AuthenticationMode) Reset() { *x = GAMResponse_AuthenticationMode{} - mi := &file_authd_proto_msgTypes[38] + mi := &file_authd_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2085,7 +2033,7 @@ func (x *GAMResponse_AuthenticationMode) String() string { func (*GAMResponse_AuthenticationMode) ProtoMessage() {} func (x *GAMResponse_AuthenticationMode) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[38] + mi := &file_authd_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2130,7 +2078,7 @@ type IARequest_AuthenticationData struct { func (x *IARequest_AuthenticationData) Reset() { *x = IARequest_AuthenticationData{} - mi := &file_authd_proto_msgTypes[39] + mi := &file_authd_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2142,7 +2090,7 @@ func (x *IARequest_AuthenticationData) String() string { func (*IARequest_AuthenticationData) ProtoMessage() {} func (x *IARequest_AuthenticationData) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[39] + mi := &file_authd_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2310,11 +2258,7 @@ const file_authd_proto_rawDesc = "" + "\n" + "IAResponse\x12\x16\n" + "\x06access\x18\x01 \x01(\tR\x06access\x12\x10\n" + - "\x03msg\x18\x02 \x01(\tR\x03msg\"E\n" + - "\n" + - "STBRequest\x12\x1b\n" + - "\tbroker_id\x18\x01 \x01(\tR\bbrokerId\x12\x1a\n" + - "\busername\x18\x02 \x01(\tR\busername\"*\n" + + "\x03msg\x18\x02 \x01(\tR\x03msg\"*\n" + "\tESRequest\x12\x1d\n" + "\n" + "session_id\x18\x01 \x01(\tR\tsessionId\"R\n" + @@ -2388,7 +2332,7 @@ const file_authd_proto_rawDesc = "" + "\vSessionMode\x12\r\n" + "\tUNDEFINED\x10\x00\x12\t\n" + "\x05LOGIN\x10\x01\x12\x13\n" + - "\x0fCHANGE_PASSWORD\x10\x022\xb9\x03\n" + + "\x0fCHANGE_PASSWORD\x10\x022\x8b\x03\n" + "\x03PAM\x123\n" + "\x10AvailableBrokers\x12\f.authd.Empty\x1a\x11.authd.ABResponse\x120\n" + "\tGetBroker\x12\x10.authd.GBRequest\x1a\x11.authd.GBResponse\x123\n" + @@ -2397,8 +2341,7 @@ const file_authd_proto_rawDesc = "" + "\x18SelectAuthenticationMode\x12\x11.authd.SAMRequest\x1a\x12.authd.SAMResponse\x126\n" + "\x0fIsAuthenticated\x12\x10.authd.IARequest\x1a\x11.authd.IAResponse\x12,\n" + "\n" + - "EndSession\x12\x10.authd.ESRequest\x1a\f.authd.Empty\x12,\n" + - "\tSetBroker\x12\x11.authd.STBRequest\x1a\f.authd.Empty2\xb1\x06\n" + + "EndSession\x12\x10.authd.ESRequest\x1a\f.authd.Empty2\xb1\x06\n" + "\vUserService\x129\n" + "\rGetUserByName\x12\x1b.authd.GetUserByNameRequest\x1a\v.authd.User\x125\n" + "\vGetUserByID\x12\x19.authd.GetUserByIDRequest\x1a\v.authd.User\x12'\n" + @@ -2433,7 +2376,7 @@ func file_authd_proto_rawDescGZIP() []byte { } var file_authd_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 40) +var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 39) var file_authd_proto_goTypes = []any{ (SessionMode)(0), // 0: authd.SessionMode (*Empty)(nil), // 1: authd.Empty @@ -2450,88 +2393,85 @@ var file_authd_proto_goTypes = []any{ (*SAMResponse)(nil), // 12: authd.SAMResponse (*IARequest)(nil), // 13: authd.IARequest (*IAResponse)(nil), // 14: authd.IAResponse - (*STBRequest)(nil), // 15: authd.STBRequest - (*ESRequest)(nil), // 16: authd.ESRequest - (*GetUserByNameRequest)(nil), // 17: authd.GetUserByNameRequest - (*GetUserByIDRequest)(nil), // 18: authd.GetUserByIDRequest - (*LockUserRequest)(nil), // 19: authd.LockUserRequest - (*UnlockUserRequest)(nil), // 20: authd.UnlockUserRequest - (*DeleteUserRequest)(nil), // 21: authd.DeleteUserRequest - (*DeleteGroupRequest)(nil), // 22: authd.DeleteGroupRequest - (*GetGroupByNameRequest)(nil), // 23: authd.GetGroupByNameRequest - (*GetGroupByIDRequest)(nil), // 24: authd.GetGroupByIDRequest - (*SetUserIDRequest)(nil), // 25: authd.SetUserIDRequest - (*SetUserIDResponse)(nil), // 26: authd.SetUserIDResponse - (*SetGroupIDRequest)(nil), // 27: authd.SetGroupIDRequest - (*SetGroupIDResponse)(nil), // 28: authd.SetGroupIDResponse - (*SetShellRequest)(nil), // 29: authd.SetShellRequest - (*SetShellResponse)(nil), // 30: authd.SetShellResponse - (*SetHomeDirRequest)(nil), // 31: authd.SetHomeDirRequest - (*SetHomeDirResponse)(nil), // 32: authd.SetHomeDirResponse - (*DeleteUserResponse)(nil), // 33: authd.DeleteUserResponse - (*User)(nil), // 34: authd.User - (*Users)(nil), // 35: authd.Users - (*Group)(nil), // 36: authd.Group - (*Groups)(nil), // 37: authd.Groups - (*ABResponse_BrokerInfo)(nil), // 38: authd.ABResponse.BrokerInfo - (*GAMResponse_AuthenticationMode)(nil), // 39: authd.GAMResponse.AuthenticationMode - (*IARequest_AuthenticationData)(nil), // 40: authd.IARequest.AuthenticationData + (*ESRequest)(nil), // 15: authd.ESRequest + (*GetUserByNameRequest)(nil), // 16: authd.GetUserByNameRequest + (*GetUserByIDRequest)(nil), // 17: authd.GetUserByIDRequest + (*LockUserRequest)(nil), // 18: authd.LockUserRequest + (*UnlockUserRequest)(nil), // 19: authd.UnlockUserRequest + (*DeleteUserRequest)(nil), // 20: authd.DeleteUserRequest + (*DeleteGroupRequest)(nil), // 21: authd.DeleteGroupRequest + (*GetGroupByNameRequest)(nil), // 22: authd.GetGroupByNameRequest + (*GetGroupByIDRequest)(nil), // 23: authd.GetGroupByIDRequest + (*SetUserIDRequest)(nil), // 24: authd.SetUserIDRequest + (*SetUserIDResponse)(nil), // 25: authd.SetUserIDResponse + (*SetGroupIDRequest)(nil), // 26: authd.SetGroupIDRequest + (*SetGroupIDResponse)(nil), // 27: authd.SetGroupIDResponse + (*SetShellRequest)(nil), // 28: authd.SetShellRequest + (*SetShellResponse)(nil), // 29: authd.SetShellResponse + (*SetHomeDirRequest)(nil), // 30: authd.SetHomeDirRequest + (*SetHomeDirResponse)(nil), // 31: authd.SetHomeDirResponse + (*DeleteUserResponse)(nil), // 32: authd.DeleteUserResponse + (*User)(nil), // 33: authd.User + (*Users)(nil), // 34: authd.Users + (*Group)(nil), // 35: authd.Group + (*Groups)(nil), // 36: authd.Groups + (*ABResponse_BrokerInfo)(nil), // 37: authd.ABResponse.BrokerInfo + (*GAMResponse_AuthenticationMode)(nil), // 38: authd.GAMResponse.AuthenticationMode + (*IARequest_AuthenticationData)(nil), // 39: authd.IARequest.AuthenticationData } var file_authd_proto_depIdxs = []int32{ - 38, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo + 37, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo 0, // 1: authd.SBRequest.mode:type_name -> authd.SessionMode 9, // 2: authd.GAMRequest.supported_ui_layouts:type_name -> authd.UILayout - 39, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode + 38, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode 9, // 4: authd.SAMResponse.ui_layout_info:type_name -> authd.UILayout - 40, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData - 34, // 6: authd.Users.users:type_name -> authd.User - 36, // 7: authd.Groups.groups:type_name -> authd.Group + 39, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData + 33, // 6: authd.Users.users:type_name -> authd.User + 35, // 7: authd.Groups.groups:type_name -> authd.Group 1, // 8: authd.PAM.AvailableBrokers:input_type -> authd.Empty 2, // 9: authd.PAM.GetBroker:input_type -> authd.GBRequest 6, // 10: authd.PAM.SelectBroker:input_type -> authd.SBRequest 8, // 11: authd.PAM.GetAuthenticationModes:input_type -> authd.GAMRequest 11, // 12: authd.PAM.SelectAuthenticationMode:input_type -> authd.SAMRequest 13, // 13: authd.PAM.IsAuthenticated:input_type -> authd.IARequest - 16, // 14: authd.PAM.EndSession:input_type -> authd.ESRequest - 15, // 15: authd.PAM.SetBroker:input_type -> authd.STBRequest - 17, // 16: authd.UserService.GetUserByName:input_type -> authd.GetUserByNameRequest - 18, // 17: authd.UserService.GetUserByID:input_type -> authd.GetUserByIDRequest - 1, // 18: authd.UserService.ListUsers:input_type -> authd.Empty - 19, // 19: authd.UserService.LockUser:input_type -> authd.LockUserRequest - 20, // 20: authd.UserService.UnlockUser:input_type -> authd.UnlockUserRequest - 25, // 21: authd.UserService.SetUserID:input_type -> authd.SetUserIDRequest - 27, // 22: authd.UserService.SetGroupID:input_type -> authd.SetGroupIDRequest - 29, // 23: authd.UserService.SetShell:input_type -> authd.SetShellRequest - 31, // 24: authd.UserService.SetHomeDir:input_type -> authd.SetHomeDirRequest - 21, // 25: authd.UserService.DeleteUser:input_type -> authd.DeleteUserRequest - 22, // 26: authd.UserService.DeleteGroup:input_type -> authd.DeleteGroupRequest - 23, // 27: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest - 24, // 28: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest - 1, // 29: authd.UserService.ListGroups:input_type -> authd.Empty - 4, // 30: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse - 3, // 31: authd.PAM.GetBroker:output_type -> authd.GBResponse - 7, // 32: authd.PAM.SelectBroker:output_type -> authd.SBResponse - 10, // 33: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse - 12, // 34: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse - 14, // 35: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse - 1, // 36: authd.PAM.EndSession:output_type -> authd.Empty - 1, // 37: authd.PAM.SetBroker:output_type -> authd.Empty - 34, // 38: authd.UserService.GetUserByName:output_type -> authd.User - 34, // 39: authd.UserService.GetUserByID:output_type -> authd.User - 35, // 40: authd.UserService.ListUsers:output_type -> authd.Users - 1, // 41: authd.UserService.LockUser:output_type -> authd.Empty - 1, // 42: authd.UserService.UnlockUser:output_type -> authd.Empty - 26, // 43: authd.UserService.SetUserID:output_type -> authd.SetUserIDResponse - 28, // 44: authd.UserService.SetGroupID:output_type -> authd.SetGroupIDResponse - 30, // 45: authd.UserService.SetShell:output_type -> authd.SetShellResponse - 32, // 46: authd.UserService.SetHomeDir:output_type -> authd.SetHomeDirResponse - 33, // 47: authd.UserService.DeleteUser:output_type -> authd.DeleteUserResponse - 1, // 48: authd.UserService.DeleteGroup:output_type -> authd.Empty - 36, // 49: authd.UserService.GetGroupByName:output_type -> authd.Group - 36, // 50: authd.UserService.GetGroupByID:output_type -> authd.Group - 37, // 51: authd.UserService.ListGroups:output_type -> authd.Groups - 30, // [30:52] is the sub-list for method output_type - 8, // [8:30] is the sub-list for method input_type + 15, // 14: authd.PAM.EndSession:input_type -> authd.ESRequest + 16, // 15: authd.UserService.GetUserByName:input_type -> authd.GetUserByNameRequest + 17, // 16: authd.UserService.GetUserByID:input_type -> authd.GetUserByIDRequest + 1, // 17: authd.UserService.ListUsers:input_type -> authd.Empty + 18, // 18: authd.UserService.LockUser:input_type -> authd.LockUserRequest + 19, // 19: authd.UserService.UnlockUser:input_type -> authd.UnlockUserRequest + 24, // 20: authd.UserService.SetUserID:input_type -> authd.SetUserIDRequest + 26, // 21: authd.UserService.SetGroupID:input_type -> authd.SetGroupIDRequest + 28, // 22: authd.UserService.SetShell:input_type -> authd.SetShellRequest + 30, // 23: authd.UserService.SetHomeDir:input_type -> authd.SetHomeDirRequest + 20, // 24: authd.UserService.DeleteUser:input_type -> authd.DeleteUserRequest + 21, // 25: authd.UserService.DeleteGroup:input_type -> authd.DeleteGroupRequest + 22, // 26: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest + 23, // 27: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest + 1, // 28: authd.UserService.ListGroups:input_type -> authd.Empty + 4, // 29: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse + 3, // 30: authd.PAM.GetBroker:output_type -> authd.GBResponse + 7, // 31: authd.PAM.SelectBroker:output_type -> authd.SBResponse + 10, // 32: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse + 12, // 33: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse + 14, // 34: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse + 1, // 35: authd.PAM.EndSession:output_type -> authd.Empty + 33, // 36: authd.UserService.GetUserByName:output_type -> authd.User + 33, // 37: authd.UserService.GetUserByID:output_type -> authd.User + 34, // 38: authd.UserService.ListUsers:output_type -> authd.Users + 1, // 39: authd.UserService.LockUser:output_type -> authd.Empty + 1, // 40: authd.UserService.UnlockUser:output_type -> authd.Empty + 25, // 41: authd.UserService.SetUserID:output_type -> authd.SetUserIDResponse + 27, // 42: authd.UserService.SetGroupID:output_type -> authd.SetGroupIDResponse + 29, // 43: authd.UserService.SetShell:output_type -> authd.SetShellResponse + 31, // 44: authd.UserService.SetHomeDir:output_type -> authd.SetHomeDirResponse + 32, // 45: authd.UserService.DeleteUser:output_type -> authd.DeleteUserResponse + 1, // 46: authd.UserService.DeleteGroup:output_type -> authd.Empty + 35, // 47: authd.UserService.GetGroupByName:output_type -> authd.Group + 35, // 48: authd.UserService.GetGroupByID:output_type -> authd.Group + 36, // 49: authd.UserService.ListGroups:output_type -> authd.Groups + 29, // [29:50] is the sub-list for method output_type + 8, // [8:29] is the sub-list for method input_type 8, // [8:8] is the sub-list for extension type_name 8, // [8:8] is the sub-list for extension extendee 0, // [0:8] is the sub-list for field type_name @@ -2543,8 +2483,8 @@ func file_authd_proto_init() { return } file_authd_proto_msgTypes[8].OneofWrappers = []any{} - file_authd_proto_msgTypes[37].OneofWrappers = []any{} - file_authd_proto_msgTypes[39].OneofWrappers = []any{ + file_authd_proto_msgTypes[36].OneofWrappers = []any{} + file_authd_proto_msgTypes[38].OneofWrappers = []any{ (*IARequest_AuthenticationData_Secret)(nil), (*IARequest_AuthenticationData_Wait)(nil), (*IARequest_AuthenticationData_Skip)(nil), @@ -2556,7 +2496,7 @@ func file_authd_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_authd_proto_rawDesc), len(file_authd_proto_rawDesc)), NumEnums: 1, - NumMessages: 40, + NumMessages: 39, NumExtensions: 0, NumServices: 2, }, diff --git a/internal/proto/authd/authd.proto b/internal/proto/authd/authd.proto index 531a7153ef..e4fcb15654 100644 --- a/internal/proto/authd/authd.proto +++ b/internal/proto/authd/authd.proto @@ -16,7 +16,6 @@ service PAM { rpc IsAuthenticated(IARequest) returns (IAResponse); rpc EndSession(ESRequest) returns (Empty); - rpc SetBroker(STBRequest) returns (Empty); } message GBRequest { @@ -120,10 +119,6 @@ message IAResponse { string msg = 2; } -message STBRequest { - string broker_id = 1; - string username = 2; -} message ESRequest { string session_id = 1; diff --git a/internal/proto/authd/authd_grpc.pb.go b/internal/proto/authd/authd_grpc.pb.go index ca7b3860f9..675a723595 100644 --- a/internal/proto/authd/authd_grpc.pb.go +++ b/internal/proto/authd/authd_grpc.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v3.21.12 +// - protoc-gen-go-grpc v1.6.0 +// - protoc v6.33.1 // source: authd.proto package authd @@ -26,7 +26,6 @@ const ( PAM_SelectAuthenticationMode_FullMethodName = "/authd.PAM/SelectAuthenticationMode" PAM_IsAuthenticated_FullMethodName = "/authd.PAM/IsAuthenticated" PAM_EndSession_FullMethodName = "/authd.PAM/EndSession" - PAM_SetBroker_FullMethodName = "/authd.PAM/SetBroker" ) // PAMClient is the client API for PAM service. @@ -40,7 +39,6 @@ type PAMClient interface { SelectAuthenticationMode(ctx context.Context, in *SAMRequest, opts ...grpc.CallOption) (*SAMResponse, error) IsAuthenticated(ctx context.Context, in *IARequest, opts ...grpc.CallOption) (*IAResponse, error) EndSession(ctx context.Context, in *ESRequest, opts ...grpc.CallOption) (*Empty, error) - SetBroker(ctx context.Context, in *STBRequest, opts ...grpc.CallOption) (*Empty, error) } type pAMClient struct { @@ -121,16 +119,6 @@ func (c *pAMClient) EndSession(ctx context.Context, in *ESRequest, opts ...grpc. return out, nil } -func (c *pAMClient) SetBroker(ctx context.Context, in *STBRequest, opts ...grpc.CallOption) (*Empty, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(Empty) - err := c.cc.Invoke(ctx, PAM_SetBroker_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - // PAMServer is the server API for PAM service. // All implementations must embed UnimplementedPAMServer // for forward compatibility. @@ -142,7 +130,6 @@ type PAMServer interface { SelectAuthenticationMode(context.Context, *SAMRequest) (*SAMResponse, error) IsAuthenticated(context.Context, *IARequest) (*IAResponse, error) EndSession(context.Context, *ESRequest) (*Empty, error) - SetBroker(context.Context, *STBRequest) (*Empty, error) mustEmbedUnimplementedPAMServer() } @@ -174,9 +161,6 @@ func (UnimplementedPAMServer) IsAuthenticated(context.Context, *IARequest) (*IAR func (UnimplementedPAMServer) EndSession(context.Context, *ESRequest) (*Empty, error) { return nil, status.Error(codes.Unimplemented, "method EndSession not implemented") } -func (UnimplementedPAMServer) SetBroker(context.Context, *STBRequest) (*Empty, error) { - return nil, status.Error(codes.Unimplemented, "method SetBroker not implemented") -} func (UnimplementedPAMServer) mustEmbedUnimplementedPAMServer() {} func (UnimplementedPAMServer) testEmbeddedByValue() {} @@ -324,24 +308,6 @@ func _PAM_EndSession_Handler(srv interface{}, ctx context.Context, dec func(inte return interceptor(ctx, in, info, handler) } -func _PAM_SetBroker_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(STBRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(PAMServer).SetBroker(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: PAM_SetBroker_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(PAMServer).SetBroker(ctx, req.(*STBRequest)) - } - return interceptor(ctx, in, info, handler) -} - // PAM_ServiceDesc is the grpc.ServiceDesc for PAM service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) @@ -377,10 +343,6 @@ var PAM_ServiceDesc = grpc.ServiceDesc{ MethodName: "EndSession", Handler: _PAM_EndSession_Handler, }, - { - MethodName: "SetBroker", - Handler: _PAM_SetBroker_Handler, - }, }, Streams: []grpc.StreamDesc{}, Metadata: "authd.proto", diff --git a/internal/services/manager.go b/internal/services/manager.go index 78f54a009d..5090a0e3ba 100644 --- a/internal/services/manager.go +++ b/internal/services/manager.go @@ -43,7 +43,7 @@ func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBr permissionManager := permissions.New() userService := user.NewService(ctx, userManager, brokerManager, &permissionManager) - pamService := pam.NewService(ctx, userManager, brokerManager, &permissionManager, pamConfig) + pamService := pam.NewService(ctx, userManager, brokerManager, pamConfig) return Manager{ userManager: userManager, diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 684e8d57eb..dd964c4b5b 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -453,6 +453,19 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res } } + // Set the broker as the default for the user on each successful authentication, + // unless it's the local broker (which is selected based on NSS resolution, not stored). + if broker.ID != brokers.LocalBrokerName { + if err = s.brokerManager.SetBroker(broker.ID, uInfo.Name); err != nil { + log.Errorf(ctx, "IsAuthenticated: Could not set default broker %q for user %q: %v", broker.ID, uInfo.Name, err) + return nil, err + } + if err = s.userManager.UpdateBrokerForUser(uInfo.Name, broker.ID); err != nil { + log.Errorf(ctx, "IsAuthenticated: Could not update broker for user %q in database: %v", uInfo.Name, err) + return nil, err + } + } + s.failedAuths.recordSuccess(username) return &authd.IAResponse{ @@ -461,39 +474,6 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res }, nil } -// SetBroker sets the default broker for the given user. -func (s Service) SetBroker(ctx context.Context, req *authd.STBRequest) (empty *authd.Empty, err error) { - defer decorate.OnError(&err, "can't set default broker %q for user %q", req.GetBrokerId(), req.GetUsername()) - - // authd usernames are lowercase - username := strings.ToLower(req.GetUsername()) - brokerID := req.GetBrokerId() - - if username == "" { - log.Errorf(ctx, "SetBroker: No user name given") - return nil, status.Error(codes.InvalidArgument, "no user name given") - } - - // Don't allow setting the default broker to the local broker, because the decision to use the local broker should - // be made each time the user tries to log in, based on whether the user is provided by any other NSS service. - if brokerID == brokers.LocalBrokerName { - log.Errorf(ctx, "SetBroker: Can't set local broker as default for user %q", username) - return nil, status.Error(codes.InvalidArgument, "can't set local broker as default") - } - - if err = s.brokerManager.SetBroker(brokerID, username); err != nil { - log.Errorf(ctx, "SetBroker: Could not set default broker %q for user %q: %v", brokerID, username, err) - return &authd.Empty{}, err - } - - if err = s.userManager.UpdateBrokerForUser(username, brokerID); err != nil { - log.Errorf(ctx, "SetBroker: Could not update broker for user %q in database: %v", username, err) - return &authd.Empty{}, err - } - - return &authd.Empty{}, nil -} - // EndSession asks the broker associated with the sessionID to end the session. func (s Service) EndSession(ctx context.Context, req *authd.ESRequest) (empty *authd.Empty, err error) { defer decorate.OnError(&err, "could not abort session") diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 1b1fd01d03..e090e618c6 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -651,64 +651,6 @@ func TestIDGeneration(t *testing.T) { } } -func TestSetBroker(t *testing.T) { - t.Parallel() - - tests := map[string]struct { - username string - brokerID string - - wantErr bool - }{ - "Set_broker_for_existing_user_with_no_broker": {username: "usersetbroker@example.com"}, - "Update_broker_for_existing_user_with_a_broker": {username: "userupdatebroker@example.com"}, - "Username_is_case_insensitive": {username: "UserSetBroker@example.com"}, - - "Error_when_setting_broker_to_local_broker": {username: "userlocalbroker@example.com", brokerID: brokers.LocalBrokerName, wantErr: true}, - "Error_when_username_is_empty": {wantErr: true}, - "Error_when_user_does_not_exist_": {username: "doesnotexist@example.com", wantErr: true}, - "Error_when_broker_does_not_exist": {username: "userwithbroker@example.com", brokerID: "does not exist", wantErr: true}, - } - for name, tc := range tests { - t.Run(name, func(t *testing.T) { - t.Parallel() - - dbDir := t.TempDir() - err := db.Z_ForTests_CreateDBFromYAML(filepath.Join(testutils.TestFamilyPath(t), "set-broker.db"), dbDir) - require.NoError(t, err, "Setup: could not create database from testdata") - - m, err := users.NewManager(users.DefaultConfig, dbDir) - require.NoError(t, err, "Setup: could not create user manager") - t.Cleanup(func() { _ = m.Stop() }) - client := newPamClient(t, m, globalBrokerManager) - - if tc.brokerID == "" { - tc.brokerID = mockBrokerGeneratedID - } - - stbReq := &authd.STBRequest{ - BrokerId: tc.brokerID, - Username: tc.username, - } - _, err = client.SetBroker(context.Background(), stbReq) - if tc.wantErr { - require.Error(t, err, "SetBroker should return an error, but did not") - return - } - require.NoError(t, err, "SetBroker should not return an error, but did") - - gbResp, err := client.GetBroker(context.Background(), &authd.GBRequest{Username: tc.username}) - require.NoError(t, err, "GetBroker should not return an error") - require.Equal(t, tc.brokerID, gbResp.GetBroker(), "SetBroker should set the default broker as expected") - - // Check that database has been updated too. - gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m)) - require.NoError(t, err, "Setup: failed to dump database for comparing") - golden.CheckOrUpdate(t, gotDB, golden.WithPath("cache.db")) - }) - } -} - func TestEndSession(t *testing.T) { t.Parallel() diff --git a/internal/services/testdata/golden/TestRegisterGRPCServices b/internal/services/testdata/golden/TestRegisterGRPCServices index 94c95fb443..12f1629588 100644 --- a/internal/services/testdata/golden/TestRegisterGRPCServices +++ b/internal/services/testdata/golden/TestRegisterGRPCServices @@ -21,9 +21,6 @@ authd.PAM: - name: SelectBroker isclientstream: false isserverstream: false - - name: SetBroker - isclientstream: false - isserverstream: false metadata: authd.proto authd.UserService: methods: diff --git a/pam/integration-tests/cli_test.go b/pam/integration-tests/cli_test.go index 1d688c55da..90bb7820e4 100644 --- a/pam/integration-tests/cli_test.go +++ b/pam/integration-tests/cli_test.go @@ -839,11 +839,18 @@ func cliChangePasswordWithRetry(t *testing.T, c *ptytest.Console, firstNew, firs cliSendPassword(t, c, secondNew) } -// cliWaitForResult waits for the complete PAM AcctMgmt() result block. +// cliWaitForResult waits for the complete PAM Authenticate() result block. func cliWaitForResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionAuthenticate) +} + +// cliWaitForChangeAuthTokResult waits for the complete PAM ChangeAuthTok() result block. +func cliWaitForChangeAuthTokResult(t *testing.T, c *ptytest.Console) { + t.Helper() + + waitForRunnerResult(t, c, pam_test.RunnerResultActionChangeAuthTok) } func cliAuthenticateWithQRCode(t *testing.T, c *ptytest.Console, signalFn func(string), username string) { @@ -910,7 +917,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) c2 := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionLogin, cliEnv, clientOptions{}) @@ -941,7 +948,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) c2 := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionLogin, cliEnv, clientOptions{}) @@ -989,7 +996,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1004,7 +1011,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c1, "goodpass") cliChangePasswordWithRetry(t, c1, "noble2404", "noble2404", `new password does not match criteria`, "authd2404") - cliWaitForResult(t, c1) + cliWaitForChangeAuthTokResult(t, c1) c1.RequireSuccessfulExit(t) // Repeat the flow to verify that after a rejection, the user can still change the password successfully. @@ -1017,7 +1024,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c2, "authd2404") cliChangePasswordWithRetry(t, c2, "noble2404", "noble2404", `new password does not match criteria`, "goodpass") - cliWaitForResult(t, c2) + cliWaitForChangeAuthTokResult(t, c2) c2.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c1) + ptySanitizeSnapshots(t, c2) @@ -1037,7 +1044,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1052,7 +1059,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "goodpass") cliChangePasswordWithRetry(t, c, "authd2404", "badpass", `Password entries don't match`, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1079,7 +1086,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1107,9 +1114,9 @@ func TestCLIChangeAuthTok(t *testing.T) { c.WaitFor(t, `Maximum number of authentication attempts reached`) // The snapshot at this point is flaky: sometimes the PAM result // has already been rendered alongside the error message, sometimes - // not. Discard it; cliWaitForResult captures the stable final state. + // not. Discard it; cliWaitForChangeAuthTokResult captures the stable final state. c.DiscardLastSnapshot() - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1121,7 +1128,7 @@ func TestCLIChangeAuthTok(t *testing.T) { c := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionPasswd, cliEnv, clientOptions{}) cliEnterUsername(t, c, username) cliSelectBroker(t, c) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1134,7 +1141,7 @@ func TestCLIChangeAuthTok(t *testing.T) { c.WaitFor(t, `Select your provider`) c.WaitFor(t, `1\. local`) c.SendKey(t, ptytest.KeyEnter) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1147,7 +1154,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSelectBroker(t, c) c.WaitFor(t, `Gimme your password`) c.SendKey(t, ptytest.KeyCtrlC) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1160,7 +1167,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSelectBroker(t, c) c.WaitFor(t, `Gimme your password`) c.SendKey(t, ptytest.KeyCtrlD) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1233,7 +1240,4 @@ func TestPamCLIRunStandalone(t *testing.T) { if !strings.Contains(outStr, pam.ErrAuthinfoUnavail.Error()) { t.Errorf("Expected output to contain %s", pam.ErrAuthinfoUnavail.Error()) } - if !strings.Contains(outStr, pam.ErrIgnore.Error()) { - t.Errorf("Expected output to contain %s", pam.ErrIgnore.Error()) - } } diff --git a/pam/integration-tests/gdm_test.go b/pam/integration-tests/gdm_test.go index 391e397078..d1d1331447 100644 --- a/pam/integration-tests/gdm_test.go +++ b/pam/integration-tests/gdm_test.go @@ -165,7 +165,6 @@ func TestGdmModule(t *testing.T) { wantAuthResponses []*authd.IAResponse wantPamInfoMessages []string wantPamErrorMessages []string - wantAcctMgmtErr error }{ "Authenticates_user": { eventPollResponses: map[gdm.EventType][]*gdm.EventData{ @@ -778,16 +777,14 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "GDM protocol initialization failed, type hello, version 9999", }, - wantError: pam.ErrCredUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrCredUnavail, }, "Error_on_connection_failure": { moduleArgs: []string{"socket=/some-path/not-existent-socket"}, wantPamErrorMessages: []string{ "could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client", }, - wantError: pam.ErrAuthinfoUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuthinfoUnavail, }, "Error_on_missing_user": { pamUser: ptrValue(""), @@ -799,32 +796,28 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "error InvalidArgument from server: no user name provided", }, - wantError: pam.ErrSystem, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrSystem, }, "Error_on_no_supported_layouts": { supportedLayouts: []*authd.UILayout{}, wantPamErrorMessages: []string{ "UI does not support any layouts", }, - wantError: pam.ErrCredUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrCredUnavail, }, "Error_on_unknown_broker": { brokerName: "Not a valid broker!", wantPamErrorMessages: []string{ "Changing GDM stage failed: Conversation error", }, - wantError: pam.ErrSystem, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrSystem, }, "Error_(ignored)_on_local_broker_causes_fallback_error": { brokerName: brokers.LocalBrokerName, wantPamInfoMessages: []string{ "auth=incomplete", }, - wantError: pam_test.ErrIgnore, - wantAcctMgmtErr: pam.ErrAbort, + wantError: pam_test.ErrIgnore, }, "Error_on_authenticating_user_with_too_many_retries": { wantAuthModeIDs: []string{ @@ -881,8 +874,7 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "Maximum number of authentication attempts reached", }, - wantError: pam.ErrMaxtries, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrMaxtries, }, "Error_on_authenticating_unknown_user": { pamUser: ptrValue("user-unknown"), @@ -903,8 +895,7 @@ func TestGdmModule(t *testing.T) { Msg: "user not found", }, }, - wantError: pam.ErrAuth, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuth, }, "Error_on_invalid_fido_ack": { pamUserPrefix: examplebroker.UserIntegrationMfaPrefix, @@ -931,8 +922,7 @@ func TestGdmModule(t *testing.T) { Msg: fido1AuthID + " should have wait set to true", }, }, - wantError: pam.ErrAuth, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuth, }, } for name, tc := range testCases { @@ -1105,9 +1095,6 @@ func TestGdmModule(t *testing.T) { } requirePreviousBrokerForUser(t, socketPath, brokerAfterAuth, pamUser) - require.ErrorIs(t, gh.tx.AcctMgmt(pamFlags), tc.wantAcctMgmtErr, - "Account Management PAM Error messages do not match") - require.Empty(t, gh.selectedAuthModeIDs, "Some Authentication Modes IDs have not been selected") require.Empty(t, gh.selectedUILayouts, @@ -1207,9 +1194,6 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) { pamFlags = pam.Silent } - require.NoError(t, gh.tx.Authenticate(pamFlags), "Setup: Authentication failed") - requirePreviousBrokerForUser(t, socketPath, gh.selectedBrokerName, pamUser) - // We disable gdm extension support, as if it was the case when the module is loaded // again from the exec module. gdm.AdvertisePamExtensions(nil) @@ -1217,7 +1201,6 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) { require.ErrorIs(t, gh.tx.AcctMgmt(pamFlags), pam_test.ErrIgnore, "Account Management PAM Error message do not match") - requirePreviousBrokerForUser(t, socketPath, gh.selectedBrokerName, pamUser) } func buildPAMModule(t *testing.T) string { diff --git a/pam/integration-tests/helpers_test.go b/pam/integration-tests/helpers_test.go index 575795dbf1..864da7f2a4 100644 --- a/pam/integration-tests/helpers_test.go +++ b/pam/integration-tests/helpers_test.go @@ -558,9 +558,6 @@ func requireRunnerResultForUser(t *testing.T, sessionMode authd.SessionMode, use require.Contains(t, goldenContent, pam_test.RunnerAction(sessionMode).Result().Message(user), "Golden file does not include required value, consider increasing the terminal size:\n%s", goldenContent) - require.Contains(t, goldenContent, pam_test.RunnerResultActionAcctMgmt.Message(user), - "Golden file does not include required value, consider increasing the terminal size:\n%s", - goldenContent) } // requireRunnerResult checks that the golden content contains the expected diff --git a/pam/integration-tests/native_test.go b/pam/integration-tests/native_test.go index 4eb126d094..0329a2afdf 100644 --- a/pam/integration-tests/native_test.go +++ b/pam/integration-tests/native_test.go @@ -1087,16 +1087,14 @@ func nativeWaitForLoginPasswordPrompt(t *testing.T, c *ptytest.Console) { } } -// nativeWaitForResult waits for the PAM runner result line. +// nativeWaitForResult waits for the PAM runner Authenticate result line. func nativeWaitForResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionAuthenticate) } // nativeWaitForChangeAuthTokResult waits for the PAM runner ChangeAuthTok result. -// AcctMgmt is the last action to complete, so waiting for it ensures the whole -// authentication token change has finished. func nativeWaitForChangeAuthTokResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionChangeAuthTok) } diff --git a/pam/integration-tests/ssh_test.go b/pam/integration-tests/ssh_test.go index df20fe8c62..3dcb718cbe 100644 --- a/pam/integration-tests/ssh_test.go +++ b/pam/integration-tests/ssh_test.go @@ -659,10 +659,11 @@ func createSSHDServiceFile(t *testing.T, module, execChild, mkHomeModule, socket {Action: pam_test.Auth, Control: pam_test.Required, Module: "pam_unix.so"}, {Action: pam_test.Account, Control: pam_test.NewControl(accountControl), Module: module, Args: moduleArgs}, - { - Action: pam_test.Account, Control: pam_test.Optional, Module: "pam_echo.so", - Args: []string{fmt.Sprintf("%s finished for user '%%u'", pam_test.RunnerResultActionAcctMgmt.Message(""))}, - }, + // pam_permit provides a fallback PAM_SUCCESS so that account management + // succeeds even when the authd module returns PAM_IGNORE (e.g. for local + // users). In a real system other primary modules (e.g. pam_unix) fill + // this role; in the test environment authd is the only account module. + {Action: pam_test.Account, Control: pam_test.Required, Module: pam_test.Permit.String()}, {Action: pam_test.Session, Control: pam_test.Optional, Module: mkHomeModule, Args: []string{"debug", "skel=" + skelDir}}, {Action: pam_test.Session, Control: pam_test.Requisite, Module: pam_test.Permit.String()}, }) diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group index 4abd34bffe..045ae0cd42 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-local-groups-integration-auth-cli@example.com" Result: success -PAM AcctMgmt() - User: "user-local-groups-integration-auth-cli@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset index 40282c68d7..9de5dba592 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset @@ -37,7 +37,4 @@ New password: PAM Authenticate() User: "user-can-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index dbd2283774..52afcb4cc6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -60,7 +60,4 @@ Confirm password: PAM Authenticate() User: "user-needs-reset-integration-mandatory@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-mandatory@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection index e3c9816216..7af3a74caa 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection @@ -61,9 +61,6 @@ Confirm password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login (UPPERCASE) === @@ -84,9 +81,6 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login (Mixed Case) === @@ -107,7 +101,4 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully index 2de96b81c2..557b532819 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-simple-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user index f85a26a403..52729238e3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user @@ -26,7 +26,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-was-empty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-was-empty@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout index c609309b6d..c5adeb289d 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-invalid-timeout-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-invalid-timeout-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method index 78fae32a65..e5b0bf8d58 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-cli@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-cli@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user index 802001d51b..30c79ac43f 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user @@ -16,7 +16,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-preset-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-preset-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case index e93cbc4abf..cb21aec151 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-upper-case-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-upper-case-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user index 376fa04d86..d58650a01a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user @@ -16,7 +16,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-preset-upper-case-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-preset-upper-case-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode index da7224bc48..2148a0fce3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode @@ -72,7 +72,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-switch-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-switch-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker index 6004ff7618..e3e2b2384f 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker @@ -43,8 +43,4 @@ PAM Authenticate() User: "user-integration-switch-broker@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-switch-broker@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username index 29f0524954..4057bf1cfb 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username @@ -31,7 +31,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-username-switched@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-username-switched@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button index d4d75a4b01..d5b9b8db74 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button @@ -50,7 +50,4 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-form-w-button@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-form-w-button@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa index cb5fbc9897..deeafa5253 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa @@ -70,7 +70,4 @@ Unlock your phone +33... or accept request on web interface PAM Authenticate() User: "user-mfa@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index 1084e45e04..8e294f8969 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -117,7 +117,4 @@ Confirm password: PAM Authenticate() User: "user-mfa-with-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code index 43d1a6f11d..f1daa0ee98 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code @@ -160,7 +160,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations index f641231f74..7cfe2cad9b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations @@ -56,7 +56,4 @@ Code: 1337 PAM Authenticate() User: "user-integration-qrcode-static-regenerate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qrcode-static-regenerate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY index c964431a56..71b7665e38 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-tty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-tty@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session index ada4ff87f7..bbd62002c3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-tty-session@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-tty-session@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen index 831be6e995..d548db6532 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-screen@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-screen@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments index b102e352d8..3df5add7b0 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user2@example.com" Result: success -PAM AcctMgmt() - User: "user2@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user index 2e256b0dc6..a386f3f53d 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user @@ -7,8 +7,4 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset index 184b624581..5b460b5c47 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset @@ -3,8 +3,4 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached index accb5f858d..de4f1642a8 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached @@ -43,9 +43,4 @@ PAM Authenticate() User: "user-integration-max-attempts@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-max-attempts@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 3598b697bc..fdc1d6eeb2 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -135,7 +135,4 @@ Confirm password: PAM Authenticate() User: "user-needs-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist index 1b21f45269..1164720d0a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist @@ -19,9 +19,4 @@ PAM Authenticate() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd index a9fa271862..7cc10ec7f6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd @@ -3,9 +3,4 @@ PAM Authenticate() User: "" Result: error: PAM exit code: 9 Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected index 894945a2cd..4ba7f407c3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected @@ -19,8 +19,4 @@ PAM Authenticate() User: "user-local-broker" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-local-broker" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d index 734eb23bff..1e7f44f437 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d @@ -22,9 +22,4 @@ PAM Authenticate() User: "user-integration-ctrl-d@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-ctrl-d@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints index f9a032b32b..15a8be8eda 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints @@ -22,9 +22,4 @@ PAM Authenticate() User: "user-integration-sigint@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-sigint@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped index af611cb206..e8c12c0825 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped @@ -5,9 +5,4 @@ PAM Authenticate() User: "" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username index ae464fbbcb..e5c174dd22 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username @@ -38,7 +38,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-pam-preset@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pam-preset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode index 6163ce476a..f1fa136ccf 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode @@ -44,9 +44,6 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-remember-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-remember-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Second Login (broker/mode remembered) === @@ -71,7 +68,4 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-remember-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-remember-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth index b8dd7227bf..2d5706519b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth @@ -102,7 +102,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-mfa-integration-cli-passwd@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-cli-passwd@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one index af45733a71..2638ecea9c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one @@ -55,9 +55,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login === @@ -78,7 +75,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case index efa3f440d1..9dae08fd47 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case @@ -55,9 +55,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-case-insensitive-testclichangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testclichangeauthtok@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login === @@ -78,7 +75,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-case-insensitive-testclichangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testclichangeauthtok@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected index 366166c4c8..679cdc4d8e 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected @@ -19,8 +19,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d index 58277b2fd4..5f7707d180 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d @@ -22,9 +22,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-user-presses-ctrl-d@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-user-presses-ctrl-d@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints index 3124fabec0..e7d615ff44 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints @@ -22,9 +22,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails index cb35990959..d5131a331c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails @@ -43,9 +43,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist index 3a7a3bbe22..b7a2b87f5a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist @@ -19,9 +19,4 @@ PAM ChangeAuthTok() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria index cb2bde7029..aa9bd20f87 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria @@ -129,7 +129,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker index 9e2c81f226..ea03b3d5f6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker @@ -88,9 +88,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── Username: user name ──────────────────────────────────────────────────────────────────────────────── @@ -175,7 +172,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous index a2d6666f1d..fe1906bd6b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous @@ -70,7 +70,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same index 9542152cc1..c26b508b4c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same @@ -88,7 +88,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset index 4e99fd10f1..e9af1ce633 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset @@ -23,6 +23,3 @@ Confirm Password: PAM Authenticate() User: "user-can-reset-integration-accept-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset-integration-accept-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group index 283f003489..467155af4b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-local-groups-integration-auth-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-local-groups-integration-auth-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset index fc841d2619..7bdb0e373b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset @@ -17,6 +17,3 @@ Choose action: PAM Authenticate() User: "user-can-reset-integration-skip-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset-integration-skip-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index 8a08473215..7fbc125505 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -17,6 +17,3 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-mandatory-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-mandatory-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection index caa6cf0292..9e1f8ce3b3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection @@ -19,9 +19,6 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM == Password authentication == @@ -31,9 +28,6 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success Username: user-needs-reset-integration-Case-INSENSITIVE-native-testnativeauthenticate@example.com == Password authentication == @@ -43,6 +37,3 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service index 695081750c..cfec047d41 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-service-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-service-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env index 31a86622a6..73f310afad 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-auth-info-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-auth-info-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env index 02c179e7dd..7f5db7b541 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-connection-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-connection-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully index 468de97916..bd5850d2ce 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-user-successfully@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-successfully@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection index 336935bb83..22503cc904 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection @@ -12,6 +12,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout index 3fd426641d..39aee02516 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-user-successfully-with-invalid-connection-timeout@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-successfully-with-invalid-connection-timeout@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method index 399a64dd3d..643e4da66b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit index dad714ac5d..b9f46ceb97 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit @@ -4,6 +4,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-polkit-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-polkit-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case index ca78d29b15..7fe15fd1a8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-upper-case-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-upper-case-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection index 5ae2bb2c05..fc9de3aa1f 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection @@ -12,6 +12,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-user-selection-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-user-selection-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode index 6dd800538c..ea4b7e8cc0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode @@ -180,6 +180,3 @@ Enter your pin code: PAM Authenticate() User: "user-integration-switch-mode-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-switch-mode-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker index 54aa4c1eef..2fba4baee0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker @@ -38,7 +38,3 @@ PAM Authenticate() User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username index d9b27f6ac5..463ad5583b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username @@ -19,6 +19,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-username-switched-authenticate-user-switching-username@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-username-switched-authenticate-user-switching-username@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button index c931466030..c7bf941026 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button @@ -38,6 +38,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit index 479bce37ef..8efc9f9c2b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit @@ -31,6 +31,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods index 1505df8bee..f8b0855010 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods @@ -32,6 +32,3 @@ Enter your one time credential: PAM Authenticate() User: "user-auth-modes-totp_with_button,password-integration-native@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-totp_with_button,password-integration-native@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa index 87a78d2068..9ccc44170b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa @@ -56,6 +56,3 @@ Plug your fido device and press with your thumb: PAM Authenticate() User: "user-mfa-integration-auth-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-auth-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index 440f3b8ab1..d68b1689ca 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -38,6 +38,3 @@ Confirm Password: PAM Authenticate() User: "user-mfa-with-reset-integration-pwquality-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset-integration-pwquality-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password index a90b2a5c4c..9c3a3c38c3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password @@ -28,6 +28,3 @@ Confirm Password: PAM Authenticate() User: "user-mfa-with-reset-integration-same-password-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset-integration-same-password-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code index 36ba910b70..2be7f37fa2 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code @@ -164,6 +164,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY index c63d84655b..90c63b4ad5 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session index 10c33fe29d..fbdc7b3d35 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen index 81bb5bc3cc..84f63a4c00 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh index a37bad3c2c..d3bba62e9e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh @@ -77,6 +77,3 @@ Choose action: PAM Authenticate() User: "user-integration-pre-check-ssh-service-qr-code-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-service-qr-code-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code index aad56a646b..814ebc5d9d 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code @@ -157,6 +157,3 @@ Choose action: PAM Authenticate() User: "user-integration-qrcode-without-code-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qrcode-without-code-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments index b6b672ddb5..04637db022 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user index 7e44dfa810..58cf2c04a0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user @@ -4,7 +4,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit index 7e44dfa810..58cf2c04a0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit @@ -4,7 +4,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset index c8323fe627..1c0594ad7a 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset @@ -3,7 +3,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit index c8323fe627..1c0594ad7a 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit @@ -3,7 +3,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached index d13d421358..b9e189f0e8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached @@ -32,8 +32,3 @@ PAM Authenticate() User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 55f5e98e17..4a66ffdc1b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -39,6 +39,3 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-bad-password-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-bad-password-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist index 76f7fd3315..d33398432e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist @@ -8,8 +8,3 @@ PAM Authenticate() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key index 877ff14912..fd75996887 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key @@ -14,8 +14,3 @@ PAM Authenticate() User: "r" Result: error: PAM exit code: 7 Authentication failure -acct=incomplete -PAM AcctMgmt() - User: "r" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd index 4672140345..68cd8ff192 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd @@ -3,8 +3,3 @@ PAM Authenticate() User: "user-integration-native-error-if-cannot-connect-to-authd@example.com" Result: error: PAM exit code: 9 Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-error-if-cannot-connect-to-authd@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected index 9c66446065..6f59bfcc51 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected @@ -8,7 +8,3 @@ PAM Authenticate() User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped index dd0f496b21..6516897e2b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped @@ -8,8 +8,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-authd-is-stopped@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-exit-if-authd-is-stopped@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env index 4dd8cbb568..d3dfeb054e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env index d48f1a8edb..791c6a73cf 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service index 91e8643d94..f715a61b58 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username index b1471bfc5b..b4f52fcf48 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username @@ -40,6 +40,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-prevent-preset-user-from-switching-username@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-prevent-preset-user-from-switching-username@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode index d005aae478..8f80ce59f6 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode @@ -32,9 +32,6 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" - Result: success == Authentication code == 1. Proceed with Authentication code @@ -49,6 +46,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth index df7c5907d4..d151f5e767 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth @@ -63,6 +63,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-mfa-integration-native-passwd-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-native-passwd-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one index 406dbe8710..fedf0a9fc3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one @@ -18,9 +18,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-simple-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testnativechangeauthtok@example.com" - Result: success Username: user-integration-simple-testnativechangeauthtok@example.com == Password authentication == @@ -30,6 +27,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-simple-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case index a95431829b..7974c0c245 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case @@ -18,9 +18,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" - Result: success Username: user-integration-case-insensitive-testnativechangeauthtok@example.com == Password authentication == @@ -30,6 +27,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method index b8628fc56e..f20234f494 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method @@ -9,9 +9,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" - Result: success == Password authentication == Enter 'r' to cancel the request and go back to select the authentication method @@ -20,6 +17,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected index 07d50ad1ea..cc8d985323 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected @@ -10,7 +10,3 @@ PAM ChangeAuthTok() User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails index 2c95eb34ec..391dfdf268 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails @@ -34,8 +34,3 @@ PAM ChangeAuthTok() User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist index d2b117879d..c283531c57 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist @@ -10,8 +10,3 @@ PAM ChangeAuthTok() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria index 311b67b975..73fd925105 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria @@ -45,6 +45,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker index ac800e9acf..91dfee1622 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker @@ -25,6 +25,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous index 493ec54a86..f643fbd924 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous @@ -23,6 +23,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same index 4f4e6f60db..30fccea2e8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same @@ -25,6 +25,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset index ae4281bcb1..df09411b7f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset @@ -21,7 +21,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_accept_password_reset] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd index 8de58d6267..36669acedd 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd @@ -21,7 +21,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group index 1bd6c6f96d..cdb8a742bb 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com' -PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group] HOME=${AUTHD_TEST_HOME} LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd index bb77b7f20e..51f82205bb 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd] HOME=${AUTHD_TEST_HOME} LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset index fb8080c31e..c54ec6bcf2 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset @@ -15,7 +15,6 @@ Or enter 'r' to go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose action: > 2 PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_offer_password_reset] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd index 64a2acd441..18a0e12d89 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd @@ -15,7 +15,6 @@ Or enter 'r' to go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose action: > 2 PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 index ae656f2729..dbd6f3eb77 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com @@ -33,7 +32,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd index 5fca67c714..03abd99d31 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com @@ -33,7 +32,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 index 0975f1b2f3..76db1bb398 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd index 80a039dbc3..427c4f7c30 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index f06884d408..3f30d88d3a 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd index 1302d90d34..b8e8f103f6 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it index dab285f832..03fadd08dd 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com @@ -42,7 +41,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd index eefdb0f1f2..da8bb8b666 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com @@ -42,7 +41,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully index 5901bdb1c7..8ecb692893 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell index a416f110ab..97a9d83ff1 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd index a0012868bd..d146c239f6 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered index 38113540f5..ec64a1d20f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-ssh@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh@example.com' -PAM AcctMgmt() finished for user 'user-ssh@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd index acbadfec69..6923437a96 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-ssh@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh@example.com' -PAM AcctMgmt() finished for user 'user-ssh@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 index 1d591e1fd5..70022fca98 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-SSH2@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh2@example.com' -PAM AcctMgmt() finished for user 'user-ssh2@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh2@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd index a93ef27492..dbc91b268d 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-SSH2@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh2@example.com' -PAM AcctMgmt() finished for user 'user-ssh2@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh2@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd index 7dc0e511c7..43f4e11aa3 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 index 1f8f005992..7c9be52fab 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd index 8fac1364b8..d8ad6afcc4 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode index 746826e561..ad99f65bea 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode @@ -161,7 +161,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code: > 4242 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_switching_auth_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd index 44d9ea14b3..1b0f5345f2 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd @@ -161,7 +161,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code: > 4242 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button index 509202e9f9..0e10167ba3 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Enter your one time credential: > temporary pass00 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd index 9b1a519f8c..7a05f2005b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass00 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa index 462f94d74f..49d6b8d572 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa @@ -54,7 +54,6 @@ Press Enter to wait for authentication or enter 'r' to go back to select the aut (user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb: > PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com' -PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index e2bb4428ab..025b1906e1 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd index c71e3cd6bf..f941ca90e8 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password index 2b26284681..5528331944 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password @@ -26,7 +26,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd index 6d28bba64f..4ccebed8c7 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd @@ -26,7 +26,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd index a9ccb6cb46..98803ce75b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd @@ -54,7 +54,6 @@ Press Enter to wait for authentication or enter 'r' to go back to select the aut (user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb: > PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code index 7d82a9fcc4..cd93c6c352 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code @@ -75,7 +75,6 @@ Or enter 'r' to go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action: > 1 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_qr_code] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd index 708cb8016a..2e722fdc5a 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd @@ -75,7 +75,6 @@ Or enter 'r' to go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action: > 1 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 6fe9c36d2e..68b9ea8d99 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -42,7 +42,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd index 929b18daa3..1cfc1786df 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd @@ -42,7 +42,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username index 0ae33e4ff6..3786e7af62 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username @@ -38,7 +38,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Prevent_user_from_switching_username] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd index 5c72e0810f..6acfe12f85 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd @@ -38,7 +38,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode index 68ea022dd1..5da1ab5c8f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode @@ -30,7 +30,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com @@ -54,7 +53,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd index 014d739206..af61f0be2b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd @@ -30,7 +30,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com @@ -54,7 +53,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com diff --git a/pam/internal/pam_test/pam-client-dummy.go b/pam/internal/pam_test/pam-client-dummy.go index f8844d398d..652dbc813b 100644 --- a/pam/internal/pam_test/pam-client-dummy.go +++ b/pam/internal/pam_test/pam-client-dummy.go @@ -51,7 +51,6 @@ type options struct { endSessionErr error brokerForUser map[string]string - setBrokerErr error uiLayouts map[string]*authd.UILayout authModes map[string]*authd.GAMResponse_AuthenticationMode @@ -174,13 +173,6 @@ func WithEndSessionReturn(err error) func(o *options) { } } -// WithSetBrokerReturn is the option to define the SetBroker return values. -func WithSetBrokerReturn(err error) func(o *options) { - return func(o *options) { - o.setBrokerErr = err - } -} - // WithUILayout is the option to define the UI layouts supported return values. func WithUILayout(authModeID string, label string, uiLayout *authd.UILayout) func(o *options) { return func(o *options) { @@ -516,27 +508,6 @@ func (dc *DummyClient) EndSession(ctx context.Context, in *authd.ESRequest, opts return &authd.Empty{}, nil } -// SetBroker simulates SetBroker using the provided parameters. -func (dc *DummyClient) SetBroker(ctx context.Context, in *authd.STBRequest, opts ...grpc.CallOption) (*authd.Empty, error) { - log.Debugf(ctx, "SetBroker Called: %#v", in) - dc.mu.Lock() - defer dc.mu.Unlock() - if dc.setBrokerErr != nil { - return nil, dc.setBrokerErr - } - if in == nil { - return nil, errors.New("no input values provided") - } - if in.Username == "" { - return nil, errors.New("no valid username provided") - } - if in.BrokerId == "" { - return nil, errors.New("no valid broker ID provided") - } - dc.brokerForUser[in.Username] = in.BrokerId - return &authd.Empty{}, nil -} - // Utility functions for testing purposes. // SelectedUsername returns the selected Username on the client. diff --git a/pam/internal/pam_test/pam-client-dummy_test.go b/pam/internal/pam_test/pam-client-dummy_test.go index 1c622db61f..bce5289cd4 100644 --- a/pam/internal/pam_test/pam-client-dummy_test.go +++ b/pam/internal/pam_test/pam-client-dummy_test.go @@ -1162,67 +1162,6 @@ func TestEndSession(t *testing.T) { } } -func TestSetDefaultBrokerForUser(t *testing.T) { - t.Parallel() - - testCases := map[string]struct { - client authd.PAMClient - args *authd.STBRequest - - wantError error - }{ - "With_empty_options": { - client: NewDummyClient(nil), - wantError: errors.New("no input values provided"), - }, - "With_Error_return_value": { - client: NewDummyClient(nil, WithSetBrokerReturn(errTest)), - wantError: errTest, - }, - "With_valid_arguments": { - client: NewDummyClient(nil, WithSetBrokerReturn(nil)), - args: &authd.STBRequest{ - BrokerId: "broker-id", - Username: "username", - }, - }, - - // Error cases - "Error_if_no_user_name_is_provided": { - client: NewDummyClient(nil), - args: &authd.STBRequest{BrokerId: "broker-id"}, - wantError: errors.New("no valid username provided"), - }, - "Error_if_no_broker_ID_is_provided": { - client: NewDummyClient(nil), - args: &authd.STBRequest{Username: "username"}, - wantError: errors.New("no valid broker ID provided"), - }, - } - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - t.Parallel() - - ret, err := tc.client.SetBroker(context.TODO(), tc.args) - require.Equal(t, err, tc.wantError) - if err != nil { - require.Nil(t, ret) - return - } - - require.Equal(t, &authd.Empty{}, ret) - - if tc.args == nil { - return - } - retBroker, err := tc.client.GetBroker(context.TODO(), - &authd.GBRequest{Username: tc.args.Username}) - require.NoError(t, err) - require.Equal(t, tc.args.BrokerId, retBroker.Broker) - }) - } -} - func TestMain(m *testing.M) { var err error privateKey, err = rsa.GenerateKey(rand.Reader, 2048) diff --git a/pam/internal/pam_test/runner-utils.go b/pam/internal/pam_test/runner-utils.go index 85f2e7a43a..23b6a50afe 100644 --- a/pam/internal/pam_test/runner-utils.go +++ b/pam/internal/pam_test/runner-utils.go @@ -82,8 +82,6 @@ const ( RunnerResultActionAuthenticate RunnerResultAction = iota // RunnerResultActionChangeAuthTok is the string for ChangeAuthTok action. RunnerResultActionChangeAuthTok - // RunnerResultActionAcctMgmt is the string for the AcctMgmt action. - RunnerResultActionAcctMgmt ) func (result RunnerResultAction) String() string { @@ -92,8 +90,6 @@ func (result RunnerResultAction) String() string { return "PAM Authenticate()" case RunnerResultActionChangeAuthTok: return "PAM ChangeAuthTok()" - case RunnerResultActionAcctMgmt: - return "PAM AcctMgmt()" default: panic(fmt.Sprintf("Invalid PAM result %d", result)) } diff --git a/pam/pam.go b/pam/pam.go index 3b2cf0dcc3..89b2b4a168 100644 --- a/pam/pam.go +++ b/pam/pam.go @@ -34,10 +34,6 @@ type pamModule struct { } const ( - // authenticationBrokerIDKey is the Key used to store the data in the - // PAM module for the second stage authentication to select the default - // broker for the current user. - authenticationBrokerIDKey = "authd.authentication-broker-id" // alreadyAuthenticatedKey is the Key used to store in the library that // we've already authenticated with this module and so that we should not @@ -328,10 +324,6 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran } defer closeConn() - if err := mTx.SetData(authenticationBrokerIDKey, nil); err != nil { - return err - } - var exitStatus adapter.PamReturnStatus appState := adapter.NewUIModel(mTx, pamClientType, mode, conn, &exitStatus) teaOpts = append(teaOpts, tea.WithFilter(adapter.MsgFilter)) @@ -346,9 +338,6 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran if shouldSendAuthMessage(pamClientType, exitStatus.Message(), true) { sendReturnMessageToPam(mTx, exitStatus) } - if err := mTx.SetData(authenticationBrokerIDKey, exitStatus.BrokerID); err != nil { - return err - } return nil case adapter.PamReturnError: @@ -365,89 +354,9 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran } } -// AcctMgmt sets any used brokerID as default for the user. -func (h *pamModule) AcctMgmt(mTx pam.ModuleTransaction, flags pam.Flags, args []string) (err error) { - parsedArgs, logArgsIssues := parseArgs(args) - closeLogging, err := initLogging(mTx, parsedArgs, flags) - defer closeLogging() - defer func() { - log.Debugf(context.TODO(), "AcctMgmt: exiting with error %v", err) - }() - if err != nil { - return err - } - logArgsIssues() - - // We ignore AcctMgmt in case we're loading the module through the exec client - serviceName, err := mTx.GetItem(pam.Service) - if err != nil { - log.Warningf(context.TODO(), "Impossible to get PAM service name: %v", err) - return pam.ErrIgnore - } - if serviceName == gdmServiceName && !gdm.IsPamExtensionSupported(gdm.PamExtensionCustomJSON) { - return pam.ErrIgnore - } - - brokerData, err := mTx.GetData(authenticationBrokerIDKey) - if err != nil && errors.Is(err, pam.ErrNoModuleData) { - return pam.ErrIgnore - } - if brokerData == nil { - // PAM can return no data without an error after that has been unset: - // See: https://github.com/linux-pam/linux-pam/pull/780 - return pam.ErrIgnore - } - - brokerIDUsedToAuthenticate, ok := brokerData.(string) - if !ok { - msg := fmt.Sprintf("broker data has an invalid type %#v", brokerData) - log.Errorf(context.TODO(), msg) - if err := showPamMessage(mTx, pam.ErrorMsg, msg); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - - return pam.ErrIgnore - } - - // Only set the brokerID as default if we stored one after authentication. - if brokerIDUsedToAuthenticate == "" { - return pam.ErrIgnore - } - - // Get current user for broker - user, err := mTx.GetItem(pam.User) - if err != nil { - log.Errorf(context.TODO(), "AcctMgmt: could not get user from PAM: %v", err) - return err - } - - if user == "" { - if err := showPamMessage(mTx, pam.ErrorMsg, "Can't get user from PAM"); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - return pam.ErrIgnore - } - - client, closeConn, err := newClient(parsedArgs) - if err != nil { - log.Debugf(context.TODO(), "%s", err) - return pam.ErrAuthinfoUnavail - } - defer closeConn() - - req := authd.STBRequest{ - BrokerId: brokerIDUsedToAuthenticate, - Username: user, - } - if _, err := client.SetBroker(context.TODO(), &req); err != nil { - msg := err.Error() - if err := showPamMessage(mTx, pam.ErrorMsg, msg); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - return pam.ErrIgnore - } - - return nil +// AcctMgmt is ignored because broker selection is now handled server-side during IsAuthenticated. +func (h *pamModule) AcctMgmt(_ pam.ModuleTransaction, _ pam.Flags, _ []string) error { + return pam.ErrIgnore } func newClientConnection(args map[string]string) (conn *grpc.ClientConn, closeConn func(), err error) { diff --git a/pam/tools/pam-runner/pam-runner.go b/pam/tools/pam-runner/pam-runner.go index 6d44a2c0ae..73fce12825 100644 --- a/pam/tools/pam-runner/pam-runner.go +++ b/pam/tools/pam-runner/pam-runner.go @@ -166,8 +166,6 @@ func main() { printPamResult(runnerAction.Result(), user, pamRes) - // Simulate setting auth broker as default. - printPamResult(pam_test.RunnerResultActionAcctMgmt, user, tx.AcctMgmt(pamFlags)) } func noConversationHandler(style pam.Style, msg string) (string, error) { From d74313f30d4c3636e651815e92c3c9e139e924be Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Fri, 3 Jul 2026 19:57:45 +0200 Subject: [PATCH 7/8] pam: count auth.Retry responses toward the failure-delay threshold The delay was only applied when the broker returned Denied or DeniedMaxTries. Because DeniedMaxTries is only issued after N failed attempts within the same session, an attacker who opens a fresh session for every guess always receives Retry and the delay never fires. Count Retry as a failure so that the per-username counter (shared across sessions) triggers the delay regardless of which response the broker returns. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- internal/services/pam/pam.go | 2 +- internal/services/pam/pam_test.go | 37 +++++++++++++++++++++++++++++++ internal/testutils/broker.go | 4 ++++ 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index dd964c4b5b..489a21cda1 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -379,7 +379,7 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res username := s.brokerManager.UsernameFromSessionID(sessionID) if access != auth.Granted { - if access == auth.Denied || access == auth.DeniedMaxTries { + if access == auth.Denied || access == auth.DeniedMaxTries || access == auth.Retry { if count := s.failedAuths.recordFailure(username); count > s.authFailConfig.AuthFailDelayThreshold { log.Debugf(ctx, "%s: Delaying response after %d consecutive authentication failures for %q", sessionID, count, username) timer := time.NewTimer(s.authFailConfig.AuthFailDelay) diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index e090e618c6..fb56e1aff3 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -574,6 +574,43 @@ func TestIsAuthenticated_FailDelay(t *testing.T) { "attempt after threshold should be delayed") } +// TestIsAuthenticated_FailDelay_Retry verifies that auth.Retry responses also +// count toward the failure-delay threshold. An attacker who uses a fresh +// session for every guess always receives auth.Retry (the per-session +// DeniedMaxTries counter never fires), so without this the delay would never +// trigger. +func TestIsAuthenticated_FailDelay_Retry(t *testing.T) { + t.Parallel() + + client := newPamClient(t, nil, globalBrokerManager) + + // Each call uses a fresh session, mimicking an attacker who resets the + // per-session retry counter by reconnecting. + makeRetryAttempt := func() { + t.Helper() + sessionID := startSession(t, client, "ia_retry@example.com") + _, err := client.IsAuthenticated(context.Background(), &authd.IARequest{ + SessionId: sessionID, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + }) + require.NoError(t, err, "IsAuthenticated should not return an error") + } + + // The first authFailDelayThreshold failures should not be delayed. + for i := range pam.AuthFailDelayThreshold { + start := time.Now() + makeRetryAttempt() + require.Less(t, time.Since(start), pam.AuthFailDelay, + "attempt %d of %d should not trigger the fail delay", i+1, pam.AuthFailDelayThreshold) + } + + // The next failure should be delayed even though it is in a new session. + start := time.Now() + makeRetryAttempt() + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "retry attempt after threshold should be delayed") +} + func TestIsAuthenticated_FailDelayTrackerFull(t *testing.T) { // Cannot be parallel: temporarily overrides the package-level authFailMaxTracked. //nolint:paralleltest // modifies package-level authFailMaxTracked, cannot run in parallel diff --git a/internal/testutils/broker.go b/internal/testutils/broker.go index ca0c79b5ba..9adda46e31 100644 --- a/internal/testutils/broker.go +++ b/internal/testutils/broker.go @@ -306,6 +306,10 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a access = authDenied data = `{"message": "access denied"}` + case "ia_retry", "ia_retry_second": + access = authRetry + data = `{"message": "invalid credentials, please retry"}` + case "ia_retry_without_data": access = authRetry data = "" From bbc9164c5b75946ccd18afb06522f055e88a6ef3 Mon Sep 17 00:00:00 2001 From: Adrian Dombeck Date: Fri, 3 Jul 2026 20:01:24 +0200 Subject: [PATCH 8/8] pam: treat auth_fail_reset_window=0 as disabled Setting the reset window to 0 was silently broken: time.Since() always returns a non-negative duration, so the stale-entry check was always true, resetting the failure counter on every attempt and defeating brute-force protection. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- debian/authd-config/authd.yaml | 3 +- .../services/pam/auth_fail_tracker_test.go | 42 +++++++++++++++++++ internal/services/pam/pam.go | 3 +- 3 files changed, 46 insertions(+), 2 deletions(-) create mode 100644 internal/services/pam/auth_fail_tracker_test.go diff --git a/debian/authd-config/authd.yaml b/debian/authd-config/authd.yaml index 5a2c1d7bd4..66cb8d0902 100644 --- a/debian/authd-config/authd.yaml +++ b/debian/authd-config/authd.yaml @@ -36,5 +36,6 @@ ## ## auth_fail_reset_window: duration of inactivity after the last failure before ## the failure count is automatically reset. -## Accepts durations like "15m", "1h", "30s". +## Accepts durations like "15m", "1h", "30s". Set to 0 to keep failures +## accumulated indefinitely (no inactivity reset). #auth_fail_reset_window: 15m diff --git a/internal/services/pam/auth_fail_tracker_test.go b/internal/services/pam/auth_fail_tracker_test.go new file mode 100644 index 0000000000..2d9e6758bf --- /dev/null +++ b/internal/services/pam/auth_fail_tracker_test.go @@ -0,0 +1,42 @@ +package pam + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" +) + +func TestAuthFailTracker_ResetWindow_Zero_DisablesReset(t *testing.T) { + t.Parallel() + + tracker := newAuthFailTracker(Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: time.Second, + AuthFailResetWindow: 0, + }) + + // Three consecutive failures should each increment the counter rather than + // resetting it. With the bug (resetWindow == 0 always resets), count would + // stay at 1 on every call. + require.Equal(t, 1, tracker.recordFailure("user"), "first failure") + require.Equal(t, 2, tracker.recordFailure("user"), "second failure") + require.Equal(t, 3, tracker.recordFailure("user"), "third failure: counter must not have been reset") +} + +func TestAuthFailTracker_ResetWindow_NonZero_ResetsAfterInactivity(t *testing.T) { + t.Parallel() + + tracker := newAuthFailTracker(Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: time.Second, + AuthFailResetWindow: 50 * time.Millisecond, + }) + + require.Equal(t, 1, tracker.recordFailure("user"), "first failure") + require.Equal(t, 2, tracker.recordFailure("user"), "second failure") + + // After sleeping past the reset window the entry expires and the counter resets. + time.Sleep(100 * time.Millisecond) + require.Equal(t, 1, tracker.recordFailure("user"), "counter should reset after inactivity") +} diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 489a21cda1..e926f6c664 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -73,13 +73,14 @@ func newAuthFailTracker(cfg Config) *authFailTracker { // recordFailure increments the failure count for username and returns the new count. // If the previous failure is older than resetWindow the counter is reset first. +// A resetWindow of 0 keeps failures accumulated indefinitely (no inactivity reset). // When the tracker is at capacity the username is not stored, but math.MaxInt is // returned so that the delay is still applied (fail-secure). func (t *authFailTracker) recordFailure(username string) int { t.mu.Lock() defer t.mu.Unlock() e, ok := t.entries[username] - if ok && time.Since(e.lastFail) >= t.resetWindow { + if ok && t.resetWindow > 0 && time.Since(e.lastFail) >= t.resetWindow { // Stale entry: treat as fresh start. ok = false }