From 0d6928219141d6f85a8c2b13515ba044dbbbdbdc Mon Sep 17 00:00:00 2001 From: d-w-moore Date: Wed, 19 Aug 2026 12:05:23 -0400 Subject: [PATCH] [_825] pam_interactive: record TODOs marking differences in Python vs C++ client plugin --- irods/auth/pam_interactive.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/irods/auth/pam_interactive.py b/irods/auth/pam_interactive.py index 9b53ed068..35aa368d3 100644 --- a/irods/auth/pam_interactive.py +++ b/irods/auth/pam_interactive.py @@ -72,12 +72,17 @@ def auth_client_start(self, request): resp['user_name'] = self.conn.account.proxy_user resp['zone_name'] = self.conn.account.proxy_zone + #TODO check handling of FORCE_PASSWORD_PROMPT - + # This is close to what the C++ plugin (client-side) does # If not forcing a prompt, check for existing credentials (.irodsA) to attempt native auth directly if not resp.get(FORCE_PASSWORD_PROMPT, False): if self.conn.account.password and self.conn.account.derived_auth_file: resp[__NEXT_OPERATION__] = PERFORM_NATIVE_AUTH return resp + # TODO + # iRODS4j removes the passworda property from the response object + # Otherwise, begin the full interactive flow resp[__NEXT_OPERATION__] = AUTH_CLIENT_AUTH_REQUEST return resp @@ -199,6 +204,7 @@ def authenticated(self, request): if not self.depot: raise RuntimeError("auth storage object was either not set, or allowed to expire prematurely.") + # TODO: review (iRODS4j doesn't do this). if request.get(STORE_PASSWORD_IN_MEMORY): self.depot.use_client_auth_file(None)