From d1c1b7b7f14eaf6e79c4459b828c3804f36608a8 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Tue, 10 Nov 2015 19:25:48 +0100 Subject: [PATCH 09/11] DP-PAM: Split out pam_resp_otp_used This function will be used by the mocked pam responder in tests. --- src/providers/data_provider.h | 1 + src/providers/dp_pam_data_util.c | 17 +++++++++++++++++ src/providers/krb5/krb5_auth.c | 4 +--- 3 files changed, 19 insertions(+), 3 deletions(-) diff --git a/src/providers/data_provider.h b/src/providers/data_provider.h index 95301f5e7c0d8a496571fcabbb28948ddab00f71..f982410e7324d4db2b8ec1f97540c545042c26d5 100644 --- a/src/providers/data_provider.h +++ b/src/providers/data_provider.h @@ -222,6 +222,7 @@ void pam_resp_grace_login(struct pam_data *pd, uint32_t grace); void pam_resp_expired_login(struct pam_data *pd, uint32_t expire); void pam_resp_srv_msg(struct pam_data *pd, const char *str_msg); void pam_resp_otp_chpass(struct pam_data *pd); +errno_t pam_resp_otp_used(struct pam_data *pd); /* Unlike other pam_resp* function, failure of this one must * be fatal diff --git a/src/providers/dp_pam_data_util.c b/src/providers/dp_pam_data_util.c index 618b2742189bfd058c889873a662fdf4de3a5e27..08397c001cd52143b361c02fefcdd5d5ba908778 100644 --- a/src/providers/dp_pam_data_util.c +++ b/src/providers/dp_pam_data_util.c @@ -346,3 +346,20 @@ void pam_resp_otp_chpass(struct pam_data *pd) /* Not fatal */ } } + +errno_t pam_resp_otp_used(struct pam_data *pd) +{ + errno_t ret; + uint32_t otp_flag = 1; + + ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t), + (const uint8_t *) &otp_flag); + if (ret != EOK) { + DEBUG(SSSDBG_CRIT_FAILURE, + "pam_add_response failed: %d (%s).\n", + ret, sss_strerror(ret)); + return ret; + } + + return EOK; +} diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 7ed7bd73d5c36c35e3ffbbb15e61ad91be498408..55186c3dad1c006928ed4c081d2de652c3f8c2b9 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -1128,9 +1128,7 @@ static void krb5_auth_done(struct tevent_req *subreq) * (long term password) can be passed to the other modules. */ if (res->otp == true && pd->cmd == SSS_PAM_AUTHENTICATE && sss_authtok_get_type(pd->authtok) != SSS_AUTHTOK_TYPE_2FA) { - uint32_t otp_flag = 1; - ret = pam_add_response(pd, SSS_OTP, sizeof(uint32_t), - (const uint8_t *) &otp_flag); + ret = pam_resp_otp_used(pd); if (ret != EOK) { DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed: %d (%s).\n", -- 2.4.11