Passkey_child executable missing(?)

Help
1

Hi,

I’m currently trying to setup FIDO2 login for NixOS machines in my FreeIPA homelab domain.

To do so, I need to use the ipa user-add-passkey --register command, which in turn uses sssd. Since I’m fairly new to NixOS, I didn’t want to raise an issue on GitHub before confirming if this is actually a missing dependency/incompatibility through a hardcoded path or if I made a rookie mistake.

The error message I’m getting whenever I execute the command is the following:

[root@nixos:~]# ipa user-add-passkey --register --require-user-verification false --cose-type eddsa --cred-type discoverable
Anmeldename: admin
ipa: ERROR: invalid 'register': Missing executable /usr/libexec/sssd/passkey_child, use the command with LOGIN PASSKEY instead of LOGIN --register

I’m also having a hard time figuring out what to make of the error message as the suggested alternatives are both not part of the original command.

I already tried locating the passkey_child executable using find but didn’t have any luck:

[root@nixos:~]# find / -name passkey_child
find: ‘/mnt/shared’: Permission denied
find: ‘/mnt/home’: Permission denied
find: ‘/run/user/1000/doc’: Permission denied

For good measure, I tried executing the same command on the ipa server and besides it failing due to the missing USB key (I was in through SSH), it seemd to work fine.

If anyone could help me figure out how I can get this to run on NixOS, you’d make my day.

Thanks in advance.

Best,
Elastic

2

I expect this will require patching the ipa package so that it stops looking at /usr/libexec/sssd/passkey_child but instead in ${sssd}/lib/passkey_child

It might also be the case we need to change the sssd package to add the passkey support.

Might be worth opening an issue in GitHub - NixOS/nixpkgs: Nix Packages collection & NixOS as this seems like a packaging bug.

1 Like
3

I’ll mention the issue I created here so navigation is a little easier.