[SSSD] [PATCH] Handle chauthtok with PAM_PRELIM_CHECK separately
Tomas Mraz
tmraz at redhat.com
Wed Dec 16 12:39:02 UTC 2009
On Wed, 2009-12-16 at 13:04 +0100, Sumit Bose wrote:
> --- a/server/providers/proxy.c
> +++ b/server/providers/proxy.c
> @@ -137,6 +137,7 @@ static void proxy_pam_handler(struct be_req *req)
> {
> struct proxy_auth_ctx);
> break;
> case SSS_PAM_CHAUTHTOK:
> + case SSS_PAM_CHAUTHTOK_PRELIM:
> ctx =
> talloc_get_type(req->be_ctx->bet_info[BET_CHPASS].pvt_bet_data,
> struct proxy_auth_ctx);
> break;
> @@ -207,12 +208,18 @@ static void proxy_pam_handler(struct be_req
> *req) {
> cache_auth_data = true;
> }
> break;
> + case SSS_PAM_CHAUTHTOK_PRELIM:
> + DEBUG(9, ("The proxy module cannot handle
> PAM_PRELIM_CHECK "
> + "separately"));
> + pam_status = PAM_SUCCESS;
> + break;
> default:
> DEBUG(1, ("unknown PAM call"));
> pam_status=PAM_ABORT;
> }
I'd suggest here to call the pam_authenticate if priv!=1 as you do in
the SSS_PAM_CHAUTHTOK_PRELIM, and return PAM_SUCCESS only for priv==1.
--
Tomas Mraz
No matter how far down the wrong road you've gone, turn back.
Turkish proverb
More information about the sssd-devel
mailing list