[SSSD] [PATCH] Fixes for proxy provider

Sumit Bose sbose at redhat.com
Wed Nov 11 14:22:00 UTC 2009


Hi,

this patch fixes a bug in the procy provider and makes
proxy_pam_target a mandatory option, because we do not ship a matching
pam configuration for the old default.

bye,
Sumit
-------------- next part --------------
>From d5e97eca44bca580189f9bfd5371937c22d397a3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 11 Nov 2009 15:12:28 +0100
Subject: [PATCH] Fixes for proxy provider

- use the correct private data for each PAM task
- make proxy_pam_target a mandatory option for auth, chpass and access
---
 server/man/sssd.conf.5.xml |    4 +++-
 server/providers/proxy.c   |   29 +++++++++++++++++++++++------
 2 files changed, 26 insertions(+), 7 deletions(-)

diff --git a/server/man/sssd.conf.5.xml b/server/man/sssd.conf.5.xml
index 5fcfae8..c342499 100644
--- a/server/man/sssd.conf.5.xml
+++ b/server/man/sssd.conf.5.xml
@@ -570,7 +570,9 @@
                             The proxy target PAM proxies to.
                         </para>
                         <para>
-                            Default: sssd_pam_proxy_default
+                            Default: not set by default, you have to take an
+                            existing pam configuration or create a new one and
+                            add the service name here.
                         </para>
                     </listitem>
                 </varlistentry>
diff --git a/server/providers/proxy.c b/server/providers/proxy.c
index aea2df3..0a37344 100644
--- a/server/providers/proxy.c
+++ b/server/providers/proxy.c
@@ -129,9 +129,28 @@ static void proxy_pam_handler(struct be_req *req) {
     struct proxy_auth_ctx *ctx;;
     bool cache_auth_data = false;
 
-    ctx = talloc_get_type(req->be_ctx->bet_info[BET_AUTH].pvt_bet_data, struct proxy_auth_ctx);
     pd = talloc_get_type(req->req_data, struct pam_data);
 
+    switch (pd->cmd) {
+        case SSS_PAM_AUTHENTICATE:
+            ctx = talloc_get_type(req->be_ctx->bet_info[BET_AUTH].pvt_bet_data,
+                                  struct proxy_auth_ctx);
+            break;
+        case SSS_PAM_CHAUTHTOK:
+            ctx = talloc_get_type(req->be_ctx->bet_info[BET_CHPASS].pvt_bet_data,
+                                  struct proxy_auth_ctx);
+            break;
+        case SSS_PAM_ACCT_MGMT:
+            ctx = talloc_get_type(req->be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
+                                  struct proxy_auth_ctx);
+            break;
+        default:
+            DEBUG(1, ("Unsupported PAM task.\n"));
+            pd->pam_status = PAM_SUCCESS;
+            proxy_reply(req, DP_ERR_OK, PAM_SUCCESS, NULL);
+            return;
+    }
+
     conv.conv=proxy_internal_conv;
     auth_data = talloc_zero(req, struct authtok_conv);
     conv.appdata_ptr=auth_data;
@@ -2355,11 +2374,9 @@ int sssm_proxy_auth_init(struct be_ctx *bectx,
                             &ctx->pam_target);
     if (ret != EOK) goto done;
     if (!ctx->pam_target) {
-        ctx->pam_target = talloc_strdup(ctx, "sssd_pam_proxy_default");
-        if (!ctx->pam_target) {
-            ret = ENOMEM;
-            goto done;
-        }
+        DEBUG(1, ("Missing option proxy_pam_target.\n"));
+        ret = EINVAL;
+        goto done;
     }
 
     *ops = &proxy_auth_ops;
-- 
1.6.2.5



More information about the sssd-devel mailing list