himmelblau-idm / himmelblau

Azure Entra ID Authentication, with PAM and NSS modules.
GNU General Public License v3.0
29 stars 6 forks source link

MFA can respond with different user than requested #37

Closed dmulder closed 1 year ago

dmulder commented 1 year ago

Because the DAG requests the username again, we could potentially end up with a auth token for a different user than initially requested. We need to ensure this isn't allowed.