[SSSD] [PATCH] PAM: only allow missing user name for certificate

Pavel Reichl preichl at redhat.com
Thu Oct 1 13:12:06 UTC 2015


>> diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
>> index 27dddcf43c1ff6eb465e1cb58d6dddf21413dcc4..978c637e22b03d3be1e07e8dc713aa01c4bb22e5 100644
>> --- a/src/responder/pam/pamsrv_cmd.c
>> +++ b/src/responder/pam/pamsrv_cmd.c
>> @@ -957,11 +957,13 @@ static errno_t pam_forwarder_parse_data(struct cli_ctx *cctx, struct pam_data *p
>>      } else {
>>          /* Only SSS_PAM_PREAUTH request may have a missing name, e.g. if the
>>           * name is determined with the help of a certificate */
>> -        if (pd->cmd == SSS_PAM_PREAUTH) {
>> +        if (pd->cmd == SSS_PAM_PREAUTH
>> +                && may_do_cert_auth(talloc_get_type(cctx->rctx->pvt_ctx,
>> +                                                    struct pam_ctx),pd)) {

Since you might be touching the code again could you please fix this super minor nitpick (missing space after comma)? Thanks!


More information about the sssd-devel mailing list