2026-09-29 13:23 UTC
@ska@social.treehouse.systems
This would involve completely turning #OpenPAM's whole 'authenticate' pathway inside out. It would have to become event driven with a state machine.
But it's pretty terrible at the moment anyway. For starters: The API that apps have to implement is capable of prompting for username and password in one go, and even the dumb openpam_tty_conv() function can handle this.
But pam_unix's 'authenticate' pathway prompts for account and password separately.
https://cgit.freebsd.org/src/tree/contrib/openpam/modules/pam_unix/pam_unix.c#n64
Replies (1)
-
@JdeBP@tty0.social 2026-09-29 22:39
@ska@social.treehouse.systems If you want another example to look at: The PCDM-session program in TrueOS as-was, formerly known as PC-BSD, is also a PAM client. It presents a login dialogue box, and from that starts an X11 client logged in as the user chosen. It's run under xinit and dbus-launch. Take a deep breath before looking at the code. https://github.com/trueos/pcbsd/blob/master/src-qt5/PCDM/src/pcdm-xprocess.cpp#L257 #PCDM #PAM #OpenPAM #PCBSD