Give the application a chance to handle PAM_INCOMPLETE.
* modules/pam_localuser/pam_localuser.c (pam_sm_authenticate): Return
PAM_INCOMPLETE instead of PAM_SERVICE_ERR when pam_get_user returns
PAM_CONV_AGAIN.
---
modules/pam_localuser/pam_localuser.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/modules/pam_localuser/pam_localuser.c
b/modules/pam_localuser/pam_localuser.c
index 99905c20..dc7e8cae 100644
--- a/modules/pam_localuser/pam_localuser.c
+++ b/modules/pam_localuser/pam_localuser.c
@@ -60,7 +60,7 @@ int
pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
int argc, const char **argv)
{
- int i, ret = PAM_SUCCESS;
+ int i, ret;
FILE *fp;
int debug = 0;
const char *filename = "/etc/passwd";
@@ -95,9 +95,10 @@ pam_sm_authenticate (pam_handle_t *pamh, int flags UNUSED,
}
}
- if(pam_get_user(pamh, &user, NULL) != PAM_SUCCESS) {
- pam_syslog (pamh, LOG_ERR, "user name not specified yet");
- return PAM_SERVICE_ERR;
+ /* Obtain the user name. */
+ if ((ret = pam_get_user(pamh, &user, NULL)) != PAM_SUCCESS) {
+ pam_syslog (pamh, LOG_ERR, "cannot determine user name");
+ return ret == PAM_CONV_AGAIN ? PAM_INCOMPLETE : PAM_SERVICE_ERR;
}
if (user == NULL || (user_len = strlen(user)) == 0) {
--
ldv