[SSSD] [PATCH] Handle chauthtok with PAM_PRELIM_CHECK separately

Tomas Mraz tmraz at redhat.com
Wed Dec 16 12:39:02 UTC 2009


On Wed, 2009-12-16 at 13:04 +0100, Sumit Bose wrote:
> --- a/server/providers/proxy.c
> +++ b/server/providers/proxy.c
> @@ -137,6 +137,7 @@ static void proxy_pam_handler(struct be_req *req)
> {
>                                    struct proxy_auth_ctx);
>              break;
>          case SSS_PAM_CHAUTHTOK:
> +        case SSS_PAM_CHAUTHTOK_PRELIM:
>              ctx =
> talloc_get_type(req->be_ctx->bet_info[BET_CHPASS].pvt_bet_data,
>                                    struct proxy_auth_ctx);
>              break;
> @@ -207,12 +208,18 @@ static void proxy_pam_handler(struct be_req
> *req) {
>                      cache_auth_data = true;
>                  }
>                  break;
> +            case SSS_PAM_CHAUTHTOK_PRELIM:
> +                DEBUG(9, ("The proxy module cannot handle
> PAM_PRELIM_CHECK "
> +                          "separately"));
> +                pam_status = PAM_SUCCESS;
> +                break;
>              default:
>                  DEBUG(1, ("unknown PAM call"));
>                  pam_status=PAM_ABORT;
>          }

I'd suggest here to call the pam_authenticate if priv!=1 as you do in
the SSS_PAM_CHAUTHTOK_PRELIM, and return PAM_SUCCESS only for priv==1.

-- 
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
                                              Turkish proverb




More information about the sssd-devel mailing list