Makes sense, I'll do that from now on. I think I just have a PAM issue or SSSD misconfiguration, as I decided to replace 'auth [success=1 default=ignore] pam_sss.so use_first_pass' with 'auth [success=1 default=ignore] pam_sss.so require_cert_auth'
To force SmartCard Auth on a tty1 login. The effect this has only limits the system login to the PRESENCE of a smartcard, and not seemingly comparing the Certificates, but it does grab a Kerberos ticket. _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
