From a132a21a3848a0845599ad99bd051ebb41002bb6 Mon Sep 17 00:00:00 2001
From: Nicola Murino <nicola.murino@gmail.com>
Date: Sat, 18 Nov 2023 11:26:37 +0100
Subject: [PATCH] keyboard interactive auth: respect hook disabled setting

Signed-off-by: Nicola Murino <nicola.murino@gmail.com>
---
 internal/dataprovider/dataprovider.go | 29 +++++++++++++++------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/internal/dataprovider/dataprovider.go b/internal/dataprovider/dataprovider.go
index 73e25013..621bdd2e 100644
--- a/internal/dataprovider/dataprovider.go
+++ b/internal/dataprovider/dataprovider.go
@@ -3742,18 +3742,25 @@ func executeKeyboardInteractiveProgram(user *User, authHook string, client ssh.K
 }
 
 func doKeyboardInteractiveAuth(user *User, authHook string, client ssh.KeyboardInteractiveChallenge, ip, protocol string) (User, error) {
+	if err := user.LoadAndApplyGroupSettings(); err != nil {
+		return *user, err
+	}
 	var authResult int
 	var err error
-	if plugin.Handler.HasAuthScope(plugin.AuthScopeKeyboardInteractive) {
-		authResult, err = executeKeyboardInteractivePlugin(user, client, ip, protocol)
-		if authResult == 1 && err == nil {
-			authResult, err = checkKeyboardInteractiveSecondFactor(user, client, protocol)
-		}
-	} else if authHook != "" {
-		if strings.HasPrefix(authHook, "http") {
-			authResult, err = executeKeyboardInteractiveHTTPHook(user, authHook, client, ip, protocol)
+	if !user.Filters.Hooks.ExternalAuthDisabled {
+		if plugin.Handler.HasAuthScope(plugin.AuthScopeKeyboardInteractive) {
+			authResult, err = executeKeyboardInteractivePlugin(user, client, ip, protocol)
+			if authResult == 1 && err == nil {
+				authResult, err = checkKeyboardInteractiveSecondFactor(user, client, protocol)
+			}
+		} else if authHook != "" {
+			if strings.HasPrefix(authHook, "http") {
+				authResult, err = executeKeyboardInteractiveHTTPHook(user, authHook, client, ip, protocol)
+			} else {
+				authResult, err = executeKeyboardInteractiveProgram(user, authHook, client, ip, protocol)
+			}
 		} else {
-			authResult, err = executeKeyboardInteractiveProgram(user, authHook, client, ip, protocol)
+			authResult, err = doBuiltinKeyboardInteractiveAuth(user, client, ip, protocol)
 		}
 	} else {
 		authResult, err = doBuiltinKeyboardInteractiveAuth(user, client, ip, protocol)
@@ -3764,10 +3771,6 @@ func doKeyboardInteractiveAuth(user *User, authHook string, client ssh.KeyboardI
 	if authResult != 1 {
 		return *user, fmt.Errorf("keyboard interactive auth failed, result: %v", authResult)
 	}
-	err = user.LoadAndApplyGroupSettings()
-	if err != nil {
-		return *user, err
-	}
 	err = user.CheckLoginConditions()
 	if err != nil {
 		return *user, err