prompter type question
Nicolas.Williams at sun.com
Tue Mar 16 16:10:14 EDT 2010
On Tue, Mar 16, 2010 at 02:09:49PM -0500, Will Fiveash wrote:
> I'm looking at modifying the pkinit preauth plugin to prompt the user to
> insert their token and press Enter if the code doesn't find a token.
> While making this mod I came across these defines in krb5.h:
> * Prompter enhancements
> #define KRB5_PROMPT_TYPE_PASSWORD 0x1
> #define KRB5_PROMPT_TYPE_NEW_PASSWORD 0x2
> #define KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN 0x3
> #define KRB5_PROMPT_TYPE_PREAUTH 0x4
> My question; what is the proper prompt type for the prompt I'm creating
> (a reminder prompt that isn't asking for a PIN or password)?
IMO yours is a distinct prompt type.
KRB5_PROMPT_TYPE_PREAUTH should be used for such things as impending
password expiry warnings, as well as error messages. A specific prompt
type should generally be required any time the user has to take action
in response to a prompt in order to proceed:
- new password
- new password again
- OTP sync
- "insert smartcard if you have one"
That's probably a reasonably complete set.
More information about the krbdev