Give the application a chance to handle PAM_INCOMPLETE.
* modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return PAM_INCOMPLETE instead of PAM_SERVICE_ERR when pam_get_user returns PAM_CONV_AGAIN. --- modules/pam_localuser/pam_localuser.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/modules/pam_localuser/pam_localuser.c b/modules/pam_localuser/pam_localuser.c index 99905c20..dc7e8cae 100644 --- a/modules/pam_localuser/pam_localuser.c +++ b/modules/pam_localuser/pam_localuser.c @@ -60,7 +60,7 @@ int pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, int argc, const char **argv) { - int i, ret = PAM_SUCCESS; + int i, ret; FILE *fp; int debug = 0; const char *filename = "/etc/passwd"; @@ -95,9 +95,10 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED, } }
- if(pam_get_user(pamh, &user, NULL) != PAM_SUCCESS) { - pam_syslog (pamh, LOG_ERR, "user name not specified yet"); - return PAM_SERVICE_ERR; + /* Obtain the user name. */ + if ((ret = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) { + pam_syslog (pamh, LOG_ERR, "cannot determine user name"); + return ret == PAM_CONV_AGAIN ? PAM_INCOMPLETE : PAM_SERVICE_ERR; }
if (user == NULL || (user_len = strlen(user)) == 0) {