From 1f26c18754d660ec4a3111aad40874b0e5455451 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 22 Jun 2016 18:21:11 +0200 Subject: [PATCH 10/14] PAM: continue with UPN/email search if name was not found Currently we only search for UPNs if the domain part of the name was not know, with Kerberos aliases and email addresses we have to do this even if the domain name is a know domain. --- src/responder/pam/pamsrv_cmd.c | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c index 3a35c3f08821aa23051989599d45b8b7b0677da4..1c759f009321cbb322fce624b506ed07f93f997b 100644 --- a/src/responder/pam/pamsrv_cmd.c +++ b/src/responder/pam/pamsrv_cmd.c @@ -924,6 +924,39 @@ static void pam_check_user_dp_callback(uint16_t err_maj, uint32_t err_min, static int pam_check_user_search(struct pam_auth_req *preq); static int pam_check_user_done(struct pam_auth_req *preq, int ret); +static errno_t pam_cmd_assume_upn(struct pam_auth_req *preq) +{ + int ret; + + if (!preq->pd->name_is_upn + && preq->pd->logon_name != NULL + && strchr(preq->pd->logon_name, '@') != NULL) { + DEBUG(SSSDBG_TRACE_ALL, + "No entry found so far, trying UPN/email lookup with [%s].\n", + preq->pd->logon_name); + /* Assuming Kerberos principal */ + preq->domain = preq->cctx->rctx->domains; + preq->check_provider = + NEED_CHECK_PROVIDER(preq->domain->provider); + preq->pd->user = talloc_strdup(preq->pd, preq->pd->logon_name); + if (preq->pd->user == NULL) { + DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n"); + return ENOMEM; + } + preq->pd->name_is_upn = true; + preq->pd->domain = NULL; + + ret = pam_check_user_search(preq); + if (ret == EOK) { + pam_dom_forwarder(preq); + } + return EOK; + } + + return ENOENT; +} + + /* TODO: we should probably return some sort of cookie that is set in the * PAM_ENVIRONMENT, so that we can save performing some calls and cache * data. */ @@ -1220,6 +1253,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd) ret = pam_check_user_search(preq); if (ret == EOK) { pam_dom_forwarder(preq); + } else if (ret == ENOENT) { + ret = pam_cmd_assume_upn(preq); } done: @@ -1417,6 +1452,8 @@ static void pam_forwarder_cb(struct tevent_req *req) ret = pam_check_user_search(preq); if (ret == EOK) { pam_dom_forwarder(preq); + } else if (ret == ENOENT) { + ret = pam_cmd_assume_upn(preq); } done: @@ -1694,6 +1731,8 @@ static void pam_check_user_dp_callback(uint16_t err_maj, uint32_t err_min, } pam_dom_forwarder(preq); + } else if (ret == ENOENT) { + ret = pam_cmd_assume_upn(preq); } ret = pam_check_user_done(preq, ret); -- 2.1.0