[SSSD] [PATCH] Fixes for proxy provider
Sumit Bose
sbose at redhat.com
Wed Nov 11 14:22:00 UTC 2009
Hi,
this patch fixes a bug in the procy provider and makes
proxy_pam_target a mandatory option, because we do not ship a matching
pam configuration for the old default.
bye,
Sumit
-------------- next part --------------
>From d5e97eca44bca580189f9bfd5371937c22d397a3 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 11 Nov 2009 15:12:28 +0100
Subject: [PATCH] Fixes for proxy provider
- use the correct private data for each PAM task
- make proxy_pam_target a mandatory option for auth, chpass and access
---
server/man/sssd.conf.5.xml | 4 +++-
server/providers/proxy.c | 29 +++++++++++++++++++++++------
2 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/server/man/sssd.conf.5.xml b/server/man/sssd.conf.5.xml
index 5fcfae8..c342499 100644
--- a/server/man/sssd.conf.5.xml
+++ b/server/man/sssd.conf.5.xml
@@ -570,7 +570,9 @@
The proxy target PAM proxies to.
</para>
<para>
- Default: sssd_pam_proxy_default
+ Default: not set by default, you have to take an
+ existing pam configuration or create a new one and
+ add the service name here.
</para>
</listitem>
</varlistentry>
diff --git a/server/providers/proxy.c b/server/providers/proxy.c
index aea2df3..0a37344 100644
--- a/server/providers/proxy.c
+++ b/server/providers/proxy.c
@@ -129,9 +129,28 @@ static void proxy_pam_handler(struct be_req *req) {
struct proxy_auth_ctx *ctx;;
bool cache_auth_data = false;
- ctx = talloc_get_type(req->be_ctx->bet_info[BET_AUTH].pvt_bet_data, struct proxy_auth_ctx);
pd = talloc_get_type(req->req_data, struct pam_data);
+ switch (pd->cmd) {
+ case SSS_PAM_AUTHENTICATE:
+ ctx = talloc_get_type(req->be_ctx->bet_info[BET_AUTH].pvt_bet_data,
+ struct proxy_auth_ctx);
+ break;
+ case SSS_PAM_CHAUTHTOK:
+ ctx = talloc_get_type(req->be_ctx->bet_info[BET_CHPASS].pvt_bet_data,
+ struct proxy_auth_ctx);
+ break;
+ case SSS_PAM_ACCT_MGMT:
+ ctx = talloc_get_type(req->be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
+ struct proxy_auth_ctx);
+ break;
+ default:
+ DEBUG(1, ("Unsupported PAM task.\n"));
+ pd->pam_status = PAM_SUCCESS;
+ proxy_reply(req, DP_ERR_OK, PAM_SUCCESS, NULL);
+ return;
+ }
+
conv.conv=proxy_internal_conv;
auth_data = talloc_zero(req, struct authtok_conv);
conv.appdata_ptr=auth_data;
@@ -2355,11 +2374,9 @@ int sssm_proxy_auth_init(struct be_ctx *bectx,
&ctx->pam_target);
if (ret != EOK) goto done;
if (!ctx->pam_target) {
- ctx->pam_target = talloc_strdup(ctx, "sssd_pam_proxy_default");
- if (!ctx->pam_target) {
- ret = ENOMEM;
- goto done;
- }
+ DEBUG(1, ("Missing option proxy_pam_target.\n"));
+ ret = EINVAL;
+ goto done;
}
*ops = &proxy_auth_ops;
--
1.6.2.5
More information about the sssd-devel
mailing list