[OATH-Toolkit-help] [patch] Allow ignoring password in pam_unix usersfile

[Ilkka Virta]

Hi,

pam_oath currently has the capability to read a static password in 
addition to the OTP. The static part of the password is also saved
to PAM_AUTHTOK, and it could be used by another module in the PAM stack, 
for example pam_unix.so try_first_pass.

However, pam_oath also always checks the password against the one in the 
usersfile, so getting pam_oath and pam_unix to authenticate
using a simple prompt is impossible.

I can't tell from the documentation what the semantics regarding this
are supposed to be, so I suggest changing the usersfile handling such 
that if the saved password is '*' (a lone asterisk), the password check 
is disabled, allowing the use of pam_unix to check the static part of 
the password. The attached patch implements this.

liboath-ign-pw.diff
Description: Text document