Automatically wait for device login result

[adombeck]

It feels like an unnecessary step to let the user select 1. Wait for the QR code scan result on the command-line. Can't we do that automatically (and cancel/restart the waiting when the user selects 2. Request new login code)?

[3v1n0]

Not really... We can't stop PAM conversations once started, not we can do those in multiple threads.

So it implies that if we start the "waiting", then there's no way to stop it from the client side, thus we only could change the keybindings (like Enter to wait and r to go back to select things), but not the fact that user has to initiate it.

[adombeck]

How does it work in the GDM, where we do wait automatically? Could we run a loop to check in intervals if there is an authentication result (and waits for keyboard input for the rest of the time)?

[3v1n0]

In GDM we use a PAM extension, so we can manage the conversations going back and forth without user interaction (by polling).

We could have used even normal conversations, but that's possible because in GDM there's an UI with a main loop that manages the events and so we can just receive a conversation and reply automatically.

For PAM native apps, such as SSH is, that's not possible because it's SSH (or sudo, or any other PAM app) that controls the UI, so as module level we can only act to such requests.

If we'd started the waiting phase automatically without user being able to explicitly start it, then once a waiting authentication mode is selected, then there's no way to go back to select another and there's no way to request another code.

Maybe we could start the waiting phase immediately with:

== Qr Code authentication ==
Enter the code in the login page
https://ubuntu.com
       1337

  1. Check for the QR code scan result
  2. Regenerate code
Or enter 'r' to go back to select the authentication method
Choose action:
> 1

But then... If there are issues during such phase we can't notify until the user has manually requested for 1, since we couldn't just wait without user interaction or they won't be able to stop, cancel or restart it (for a new code).

[adombeck]

For PAM native apps, such as SSH is, that's not possible because it's SSH (or sudo, or any other PAM app) that controls the UI, so as module level we can only act to such requests.

Ah, so if I understand correctly, the problem is that we need to give control back to the app in order for it to print the message, and then it only calls the PAM module again once the user responded. Is that correct?