From 2c132c6eade850218f9dcd54c5db6f5efa7d7ad4 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 10 Nov 2015 19:25:48 +0100 Subject: [PATCH 09/12] DP-PAM: Split out pam_resp_otp_used This function will be used by the mocked pam responder in tests. --- src/providers/data_provider.h | 1 + src/providers/dp_pam_data_util.c | 17 +++++++++++++++++ src/providers/krb5/krb5_auth.c | 4 +--- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h index c79d710e331b846760f8b41a9ee771d87a2a157d..03396b77b00fd16523b9e3ce89ccfaa649b14523 100644 --- a/src/providers/data_provider.h +++ b/src/providers/data_provider.h @@ -222,6 +222,7 @@ void pam_resp_grace_login(struct pam_data *pd, uint32_t grace); void pam_resp_expired_login(struct pam_data *pd, uint32_t expire); void pam_resp_srv_msg(struct pam_data *pd, const char *str_msg); void pam_resp_otp_chpass(struct pam_data *pd); +errno_t pam_resp_otp_used(struct pam_data *pd); /* Unlike other pam_resp* function, failure of this one must * be fatal diff --git a/src/providers/dp_pam_data_util.c b/src/providers/dp_pam_data_util.c index 618b2742189bfd058c889873a662fdf4de3a5e27..08397c001cd52143b361c02fefcdd5d5ba908778 100644 --- a/src/providers/dp_pam_data_util.c +++ b/src/providers/dp_pam_data_util.c @@ -346,3 +346,20 @@ void pam_resp_otp_chpass(struct pam_data *pd) /* Not fatal */ } } + +errno_t pam_resp_otp_used(struct pam_data *pd) +{ + errno_t ret; + uint32_t otp_flag = 1; + + ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t), + (const uint8_t *) &otp_flag); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + "pam_add_response failed: %d (%s).\n", + ret, sss_strerror(ret)); + return ret; + } + + return EOK; +} diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index a5ecb24323d3d413bc08f100b90195d3619172d3..84a22d9901598dde3380bf3df8b6a49f6cfbb1a6 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -1116,9 +1116,7 @@ static void krb5_auth_done(struct tevent_req *subreq) * (long term password) can be passed to the other modules. */ if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE && sss_authtok_get_type(pd->authtok) != SSS_AUTHTOK_TYPE_2FA) { - uint32_t otp_flag = 1; - ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t), - (const uint8_t *) &otp_flag); + ret = pam_resp_otp_used(pd); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed: %d (%s).\n", -- 2.7.4