Q: Does the one time pass phase have to be prefixed with the user id or does the PAM plugin glue the two together before submitting the request?
A: he PAM plugin only submit the OTP for online verification. The authorization decision, i.e. to decide whether yubikey X is authorized to authenticate a login session for user Y, needs to be performed by the PAM module. This is currently not implemented, but we have an open issue for it in our bug tracker:
http://code.google.com/p/yubico-pam/issues/detail?id=4
Login
FAQ
Search
