mirror of
https://github.com/kanidm/kanidm.git
synced 2025-02-23 20:47:01 +01:00
5eb9a4430f
Since we use Debian's PAM autoconf, pam_unix isn't disabled and remains active. This means pam_unix triggers first and pam_kanidm should use the password it already tried to match to a local user. This change also moves the postinst hook for PAM config correctly to the libpam-kanidm package, since that's the one that delivers the config that needs a reinstall!
20 lines
440 B
Plaintext
20 lines
440 B
Plaintext
Name: Kanidm Authentication
|
|
Default: yes
|
|
Priority: 128
|
|
|
|
Auth-Type: Primary
|
|
Auth:
|
|
[success=end new_authtok_reqd=done default=ignore] pam_kanidm.so ignore_unknown_user use_first_pass
|
|
|
|
Account-Type: Primary
|
|
Account:
|
|
[success=end new_authtok_reqd=done default=ignore] pam_kanidm.so ignore_unknown_user
|
|
|
|
Session-Type: Additional
|
|
Session:
|
|
optional pam_kanidm.so
|
|
|
|
Password-Type: Additional
|
|
Password:
|
|
optional pam_kanidm.so
|