From 5ef4f44bd2feb221dbe70c3748fa09e522ac98a0 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Tue, 24 Mar 2015 15:35:01 +0100 Subject: [PATCH 09/14] sysdb: add sysdb_cache_password_ex() --- src/db/sysdb.h | 9 +++++++++ src/db/sysdb_ops.c | 25 ++++++++++++++++++++--- src/tests/sysdb-tests.c | 53 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 84 insertions(+), 3 deletions(-) diff --git a/src/db/sysdb.h b/src/db/sysdb.h index 2a3a2df98fa1e51cf024b7bd57347e8b02449eff..c3d2c1406321e01b325e04e0e3f263893eb91b2e 100644 --- a/src/db/sysdb.h +++ b/src/db/sysdb.h @@ -24,6 +24,7 @@ #include "util/util.h" #include "confdb/confdb.h" +#include "sss_client/sss_cli.h" #include #define CACHE_SYSDB_FILE "cache_%s.ldb" @@ -105,6 +106,8 @@ #define SYSDB_SERVERHOSTNAME "serverHostname" #define SYSDB_CACHEDPWD "cachedPassword" +#define SYSDB_CACHEDPWD_TYPE "cachedPasswordType" +#define SYSDB_CACHEDPWD_FA2_LEN "cachedPasswordSecondFactorLen" #define SYSDB_UUID "uniqueID" #define SYSDB_SID "objectSID" @@ -888,6 +891,12 @@ int sysdb_cache_password(struct sss_domain_info *domain, const char *username, const char *password); +int sysdb_cache_password_ex(struct sss_domain_info *domain, + const char *username, + const char *password, + enum sss_authtok_type authtok_type, + size_t second_factor_size); + errno_t check_failed_login_attempts(struct confdb_ctx *cdb, struct ldb_message *ldb_msg, uint32_t *failed_login_attempts, diff --git a/src/db/sysdb_ops.c b/src/db/sysdb_ops.c index 1f84a60ba332d70529b2170c04415d7fc0704597..b4b2eb9fc2ba6055fcfc770601c04815464228cd 100644 --- a/src/db/sysdb_ops.c +++ b/src/db/sysdb_ops.c @@ -2234,9 +2234,11 @@ int sysdb_remove_group_member(struct sss_domain_info *domain, /* =Password-Caching====================================================== */ -int sysdb_cache_password(struct sss_domain_info *domain, - const char *username, - const char *password) +int sysdb_cache_password_ex(struct sss_domain_info *domain, + const char *username, + const char *password, + enum sss_authtok_type authtok_type, + size_t second_factor_len) { TALLOC_CTX *tmp_ctx; struct sysdb_attrs *attrs; @@ -2269,6 +2271,15 @@ int sysdb_cache_password(struct sss_domain_info *domain, ret = sysdb_attrs_add_string(attrs, SYSDB_CACHEDPWD, hash); if (ret) goto fail; + ret = sysdb_attrs_add_long(attrs, SYSDB_CACHEDPWD_TYPE, authtok_type); + if (ret) goto fail; + + if (authtok_type == SSS_AUTHTOK_TYPE_2FA && second_factor_len > 0) { + ret = sysdb_attrs_add_long(attrs, SYSDB_CACHEDPWD_FA2_LEN, + second_factor_len); + if (ret) goto fail; + } + /* FIXME: should we use a different attribute for chache passwords ?? */ ret = sysdb_attrs_add_long(attrs, "lastCachedPasswordChange", (long)time(NULL)); @@ -2293,6 +2304,14 @@ fail: return ret; } +int sysdb_cache_password(struct sss_domain_info *domain, + const char *username, + const char *password) +{ + return sysdb_cache_password_ex(domain, username, password, + SSS_AUTHTOK_TYPE_PASSWORD, 0); +} + /* =Custom Search================== */ int sysdb_search_custom(TALLOC_CTX *mem_ctx, diff --git a/src/tests/sysdb-tests.c b/src/tests/sysdb-tests.c index a6c6b33de7be7665e5284524c840de7157ed1891..22b1de428f9918ff82fe64b0ca3941056eac21d0 100644 --- a/src/tests/sysdb-tests.c +++ b/src/tests/sysdb-tests.c @@ -1809,6 +1809,57 @@ START_TEST (test_sysdb_cache_password) } END_TEST +START_TEST (test_sysdb_cache_password_ex) +{ + struct sysdb_test_ctx *test_ctx; + struct test_data *data; + int ret; + struct ldb_result *res; + const char *attrs[] = { SYSDB_CACHEDPWD_TYPE, SYSDB_CACHEDPWD_FA2_LEN, + NULL }; + int val; + + /* Setup */ + ret = setup_sysdb_tests(&test_ctx); + fail_unless(ret == EOK, "Could not set up the test"); + + data = talloc_zero(test_ctx, struct test_data); + data->ctx = test_ctx; + data->ev = test_ctx->ev; + data->username = talloc_asprintf(data, "testuser%d", _i); + + ret = sysdb_get_user_attr(test_ctx, test_ctx->domain, data->username, + attrs, &res); + fail_unless(ret == EOK, "sysdb_get_user_attr request failed [%d].", ret); + + val = ldb_msg_find_attr_as_int(res->msgs[0], SYSDB_CACHEDPWD_TYPE, 0); + fail_unless(val == SSS_AUTHTOK_TYPE_PASSWORD, + "Unexptected authtok type, found [%d], expected [%d].", + val, SSS_AUTHTOK_TYPE_PASSWORD); + + ret = sysdb_cache_password_ex(test_ctx->domain, data->username, + data->username, SSS_AUTHTOK_TYPE_2FA, 12); + + fail_unless(ret == EOK, "sysdb_cache_password request failed [%d].", ret); + + ret = sysdb_get_user_attr(test_ctx, test_ctx->domain, data->username, + attrs, &res); + fail_unless(ret == EOK, "sysdb_get_user_attr request failed [%d].", ret); + + val = ldb_msg_find_attr_as_int(res->msgs[0], SYSDB_CACHEDPWD_TYPE, 0); + fail_unless(val == SSS_AUTHTOK_TYPE_2FA, + "Unexptected authtok type, found [%d], expected [%d].", + val, SSS_AUTHTOK_TYPE_2FA); + + val = ldb_msg_find_attr_as_int(res->msgs[0], SYSDB_CACHEDPWD_FA2_LEN, 0); + fail_unless(val == 12, + "Unexptected second factor lenght, found [%d], expected [%d].", + val, 12); + + talloc_free(test_ctx); +} +END_TEST + static void cached_authentication_without_expiration(const char *username, const char *password, int expected_result) @@ -6241,6 +6292,8 @@ Suite *create_sysdb_suite(void) 27010, 27011); tcase_add_loop_test(tc_sysdb, test_sysdb_cached_authentication, 27010, 27011); + tcase_add_loop_test(tc_sysdb, test_sysdb_cache_password_ex, 27010, 27011); + /* ASQ search test */ tcase_add_loop_test(tc_sysdb, test_sysdb_prepare_asq_test_user, 28011, 28020); tcase_add_test(tc_sysdb, test_sysdb_asq_search); -- 2.1.0