[SSSD] [PATCH] pam: sub-domain authentication fix
Sumit Bose
sbose at redhat.com
Wed Oct 1 14:28:33 UTC 2014
Hi,
I'm sorry but I introduced a regression with the recent patches which
added support for looking up users with an UPN. This patch should fix it,
please see commit message for details.
bye,
Sumit
-------------- next part --------------
From d8fe3b0ed7e92657e4864742a92dfa02d77ccb10 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose at redhat.com>
Date: Wed, 1 Oct 2014 15:22:45 +0200
Subject: [PATCH] pam: sub-domain authentication fix
With a recent patch sysdb_getpwnam() was replaced by
sysdb_get_user_by_name() in the PAM responder. Unfortunately both behave
differently with respect to sub-domain users. As a consequence the PAM
responder was not able to resolve users from sub-domains. This patch
reverts this change and uses sysdb_getpwnam() again.
---
src/responder/pam/pamsrv_cmd.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index c135e3c..ffec17b 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -1051,6 +1051,7 @@ static int pam_check_user_search(struct pam_auth_req *preq)
talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
static const char *user_attrs[] = SYSDB_PW_ATTRS;
struct ldb_message *msg;
+ struct ldb_result *res;
while (dom) {
/* if it is a domainless search, skip domains that require fully
@@ -1122,7 +1123,16 @@ static int pam_check_user_search(struct pam_auth_req *preq)
if (preq->pd->name_is_upn) {
ret = sysdb_search_user_by_upn(preq, dom, name, user_attrs, &msg);
} else {
- ret = sysdb_search_user_by_name(preq, dom, name, user_attrs, &msg);
+ ret = sysdb_getpwnam(preq, dom, name, &res);
+ if (res->count > 1) {
+ DEBUG(SSSDBG_FATAL_FAILURE,
+ "getpwnam call returned more than one result !?!\n");
+ return ENOENT;
+ } else if (res->count == 0) {
+ ret = ENOENT;
+ } else {
+ msg = res->msgs[0];
+ }
}
if (ret != EOK && ret != ENOENT) {
DEBUG(SSSDBG_CRIT_FAILURE,
--
1.8.3.1
More information about the sssd-devel
mailing list