Allow concatenating u2f_keys

[TomMD]

The u2f_keys parsing is pretty harsh and requires sed or manual editing, making it unfriendly to scripts.

Recall the format is:

<username>:<cose>:<pubkey>...:<cose2>:<pubkey2>:...

If the same username appears more than once then the prior lines are ignored (well, parsed by later discarded). Instead, just allow separate lines. In addition to being backward compatible, there is a nice sysadmin-friendly behavior allowing concatenation. Ignore the obvious bash code nits, but effectively allowing:

pam_u2fconfig -u user >> $u2f_keys_file
# or perhaps a setup that has already collected auth info
cat auth_tokens/user/*  >> /var/yubico/u2f_keys

[TomMD]

CI fails to build libfido2, which is very much not an issue with this PR but a more general problem.

[LDVG]

Hi,

Strictly speaking, this is in fact breaking current behavior. Have you considered

$ pamu2fcfg --user alice >> authfile
$ pamu2fcfg --user alice --no-user >> authfile

to register multiple credentials for a particular user?

If this is insufficient for some reason, maybe it's better for pamu2fcfg to learn how to append credentials to an existing authfile, help the user merge multiple entries, or something else.

CI fails to build libfido2, which is very much not an issue with this PR but a more general problem.

Thanks for the heads-up. We've resolved this separately through #307 .

[TomMD]

Yes, it does change current behavior. "Backwards compatible" is only in the sense of allowing one line, but not allowing lines to override.

I see the proposal for --no-user but it feels clumsy since it's a auth-generation time change and keeps a format that has to be carefully constructed.

An admin working with scripts in the form:

cat authtokens/user/* >> u2f_keys

could instead use --no-user (or sed to edit existing tokens) and then:

echo -n 'user:' >> u2f_keys
cat authtokens/user/* >> u2f_keys

It seems more fragile having to create a single legal line from different inputs (user name, token 1, token 2) collected at different times.

[LDVG]

In the understanding that this would be a breaking change or requires another module option introducing additional complexity, I will close this. We can revisit changing the authfile format on a major version change. Thank you for your contributions!