On (23/02/15 13:29), Jakub Hrozek wrote:
Hi,
I was debugging a case which could be solved much faster if the PAM
responder was louder about presenting error messages. I wonder if the
other developers are OK with adding -lpam as a new dependency for the
PAM responder, but gived sssd_be has this dependency as well, I hope
it's fine.
From 8c3b61e84d46a89f391934917862675ad0c49ca0 Mon Sep 17 00:00:00
2001
From: Jakub Hrozek <jhrozek(a)redhat.com>
Date: Mon, 23 Feb 2015 11:06:25 +0100
Subject: [PATCH] PAM: print the pam status as string, too
---
Makefile.am | 4 +++-
src/responder/pam/pamsrv_cmd.c | 3 ++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index 70278550fd22b820528f9613d30e11a723ea6c5c..5e20667f9b7a7d315f3abb57240dc320932471af
100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -988,7 +988,9 @@ sssd_pam_LDADD = \
$(TDB_LIBS) \
$(SSSD_LIBS) \
$(SELINUX_LIBS) \
- $(SSSD_INTERNAL_LTLIBS)
+ $(PAM_LIBS) \
+ $(SSSD_INTERNAL_LTLIBS) \
+ $(NULL)
if BUILD_SUDO
sssd_sudo_SOURCES = \
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 90cdbec519587a0d5dd680bfe3a991d896d6c008..79f039c61610f5f6ced155949b25a12e440cbe9c
100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -503,7 +503,8 @@ static void pam_reply(struct pam_auth_req *preq)
DEBUG(SSSDBG_FUNC_DATA,
- "pam_reply called with result [%d].\n", pd->pam_status);
+ "pam_reply called with result [%d]: %s.\n",
+ pd->pam_status, pam_strerror(NULL, pd->pam_status));
if (pd->pam_status == PAM_AUTHINFO_UNAVAIL) {
switch(pd->cmd) {
We should also print pam status as string in function
pam_dp_process_reply -> src/responder/pam/pamsrv_dp.c
DEBUG(SSSDBG_CONF_SETTINGS,
"received: [%d][%s]\n", preq->pd->pam_status,
preq->pd->domain);
and in backend as well.
dp_pam_err_to_string -> src/providers/data_provider_be.c
Pam error is printed only in in case of timeout or DP is offline.
IMHO we should print it all the time.
LS