gnome authentication agent does not list all available users

Asked by Kosmas Ntouskos

Hello,

On Ubuntu 18.04, when a non-sudo user tries to alter system settings he is prompted by policy kit to provide administration credentials.
However only one user is listed, when there are multiple sudoers.

pkexec on the other hand offers a list of users you can authenticate with to provide admin clearance.

Is there any way to make gnome authentication agent display all sudo users and have the user chose with whom to authenticate?

Question information

Language:
English Edit question
Status:
Answered
For:
Ubuntu Edit question
Assignee:
No assignee Edit question
Last query:
Last reply:
Revision history for this message
Bernard Stafford (bernard010) said :
#1
Revision history for this message
Kosmas Ntouskos (kntouskos) said :
#2

Hello Bernard,

That does not, in any way, address my question.
I am not looking to give "admin" permissions to a limited user, directly.

Please make this test to better understand the issue.

- Ubuntu 18.04
- Add user admin1 to sudoers
- Add user admin2 to sudoers
- Add user user1. This is not a sudo user.
- Log in, via the GUI, as user1
- Try to perform a task that requires administrative approval, like setting a static IP address
- What user does it ask to authenticate as? Assuming it's admin1, can you somehow authenticate as admin2?

Revision history for this message
Bernard Stafford (bernard010) said :
#3

This has to do with sudo and users with the initial configuration.
https://devopspoints.com/ubuntu-server-18-04-configuring-administrator-access-with-sudo.html
Thanks

Revision history for this message
Bernard Stafford (bernard010) said (last edit ):
#4

On a server each client has an actual login. some may be admin others are users. This is defined within the Policy kit by default.
///Very simple make a group with admin access and a different group with users access to avoid the sudo...

Revision history for this message
Kosmas Ntouskos (kntouskos) said :
#5

Hello Bernard,

I'm unsure how the article you share provides a solution for the problem I'm mentioning. Please actually READ my replies.

I do not have an issue with creating an "admin" or "simple" user. These work fine.

There are multiple users in the sudo group.
One user is bob and another user is tom. Both bob and tom are admins. Both are in the sudo group.

User kate is not an admin.
When kate tries to change the IP address, via the UI, she gets a prompt saying "System policy prevents modification of network settings for all users" and asks for bob's password in order to authenticate.
The problem is that kate does not have bob's password, she only has tom's password. However, in the ui, the gnome-authentication-agent-1, provides no way of changing bob to tom.

If kate tries to run a command via pkexec, say whoami, she does get to choose whether to authenticate as bob or tom :

 ==== AUTHENTICATION FOR org.freedesktop.policykit.exec ===
Authentication is needed to run `/usr/bin/whoami` as the super user
Multiple identities can be used for authentication:
 1. bob
 2. tom
Choose identity to authenticate as (1-2):

The case is similar to this https://askubuntu.com/questions/542397/change-default-user-for-authentication
but in my case, both tom and bob are in the sudo group and polkit is configured as AdminIdentities=unix-group:sudo.
No amount of restarting, re-logging, rebooting or whatever has showed a drop down to select between bob and tom, in gnome-authentication-agent-1.
pkexec however works.

Revision history for this message
Launchpad Janitor (janitor) said :
#6

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
Kosmas Ntouskos (kntouskos) said :
#7

Question remains unanswered.

Revision history for this message
Launchpad Janitor (janitor) said :
#8

This question was expired because it remained in the 'Open' state without activity for the last 15 days.

Revision history for this message
Kosmas Ntouskos (kntouskos) said :
#9

Question is still unanswered and problem remains.

Revision history for this message
Manfred Hampl (m-hampl) said :
#10

It seems that nobody of the people answering questions here is able to help you.
If you deem this issue being a problem, then you might consider creating a bug report.

Revision history for this message
Kosmas Ntouskos (kntouskos) said :
#11

Hello Manfred,

Thanks, I was about to create a bug originally, but it prompted me to make a question first. I was just waiting for the prompt open a bug, but unfortunately didn't get one after Bernard's last reply.

I'll open a bug and also link this question in.

Can you help with this problem?

Provide an answer of your own, or ask Kosmas Ntouskos for more information if necessary.

To post a message you must log in.