What does pampassword=asksame do?

[pklapperich]

The example config in xrdp.ini shows using pamusername=asksame and pampassword=asksame. When I use this setting, then the menu shows a user/password field when that section is selected and both fields are pre-populated with the word same.

Is asksame a keyword that's supposed to do something special, or is the syntax just pamusername=ask to instruct sesman to show a username prompt and pamusername=askfoo to have it show a username prompt pre-populated with "foo"?

I don't see this documented in the man page nor on the wiki.

xrdp/xrdp/xrdp.ini.in

Line 256 in 7868622

#pamusername=asksame

[metalefty]

As far as I grepped source code, same doesn't have special meaning. same will be prefilled in the text box.

I'm still not sure same had special meaning in the past though.

[matt335672]

There are two things going on here:-

1. ask as a prefix causes a prompt box to be displayed with the specified parameter, and the ask removed.
2. 'same' as a keyword has a special meaning for both pamusername and pampassword, in that the equivalent field is taken from the username or password respectively.

So as an extreme example, with this config on the current development build:-

[Xvnc]
name=Xvnc
lib=libvnc.so
Username=askxtestuser
Password=ask
pamusername=asksame
pampassword=asksame
ip=127.0.0.1
port=-1

I get this login box:-

When I fill in the password field with the correct password, sesman authenticates the same user twice - once for the pamusername/pampassword combination and once for the username/password combination.

Obviously this isn't a useful example. I can't however think of a sensible use of asksame off the top of my head.

[pklapperich]

So even though the text box says "same" in it, xtestuser will be sent to PAM for authentication?

[matt335672]

That's what it does on the development build. It's got to put something in there!

There is of course a small possibility you might have an account called same, in which case you can't use it for PAM authentication.