Expiring passwords and gnome keyring

Support
1

Hi,

I’ve got small issue on Alma 9.5 and Gnome. I’m using sssd with AD and GDM for login. My Authselect configuration is sssd with-mkhomedir.

My issue is when a password is reset the gnome keyring password for login is not also reset and requires a separate step to either delete it and regenerate it or reset the password on it.

  1. A password is expired through AD the users are prompted to reset their password at GDM.
  2. User resets their password by filling out the prompts at GDM and logs in
  3. Their AD credentials are now reset at this point
  4. User clicks on Chrome (google official stable chrome for their repos)
  5. Gnome key ring prompts them for their old password
  6. At this point I get a phone call and I explain the prompt to the user and they type in their old password.

What I would like to have happen instead

  1. During the GDM prompt a pam module resets the gnome default keyring.
    This seems possible given that pam has access to their new and their old password and manages to send it on to AD through sssd. Is there a configuration of pam that would allow this sort of situation?

I thought that with-pam-gnome-keyring from the authselect sssd profile might provide something like this, but it seems to only be for users of gnome-keyring that aren’t utilizing gdm manage sesssions.

Pam gnome keyring documentation mentions this as a feature and indeed it seems like it’s being used

jorussell@testalma:/etc/pam.d$ grep -R authtok
gdm-password:-password   optional       pam_gnome_keyring.so use_authtok
passwd:-password   optional	pam_gnome_keyring.so use_authtok
password-auth:password    sufficient                                   pam_unix.so sha512 shadow nullok use_authtok
password-auth:password    sufficient                                   pam_sss.so use_authtok
system-auth:password    sufficient                                   pam_unix.so sha512 shadow nullok use_authtok

But I would expect there to not be a password prompt again after using

gdm-password:-password optional pam_gnome_keyring.so use_authtok

like I am seeing. But I might be misinterpreting the documentation.

2

IIRC: the keyring password can only be (re)set, when the user is in his/her session. At the gdm stage this is not the case …

3

That could be it but I feel like this paragraph says other wise, but I can’t tell if I’m interpreting it correctly

The Gnome Keyring password module allows changing password for login keyring. If no old password was obtained by previous module in the stack, this module is ignored. On the other hand, when no new password was obtained, this module will prompt for one. Gnome Keyring daemon will be started if not already running and stopped after concluding operation if it was not running before.

4

Indeed, it sounds that the mentioned scenario is exactly and explicitly addressed. Also /etc/pam.d/gdm-passwordseems to be prepared for that. Mmmh …