Add support for require pam-account the-service-name.

2 files changed, 57 insertions, 1 deletions

diff --git a/README b/README
index f6c80b1..5becfe9 100644
--- a/README
+++ b/README
@@ -4,13 +4,16 @@ Apache module mod_authnz_pam
 
 Apache module mod_authnz_pam serves as Basic Authentication provider
 which runs the [login, password] authentication through the PAM
-stack.
+stack. It can also be used as an authorization module, supplementing
+authentication done by other modules, for example mod_auth_kerb.
 
 The primary intended use is in connection with sssd and pam_sss.so.
 
 Module configuration
 --------------------
 
+Basic Authentication:
+
 The module is configured using the
 
     AuthBasicProvider PAM
@@ -39,6 +42,31 @@ tlwiki example, file /etc/pam.d/tlwiki could be created with content
 
 to authenticate against sssd.
 
+Authorization:
+
+Let us assume there is already Kerberos authentication configured:
+
+    <Location /private>
+      AuthType Kerberos
+      AuthName "Kerberos Login"
+      KrbMethodNegotiate On
+      KrbMethodK5Passwd Off
+      KrbAuthRealms EXAMPLE.COM
+      Krb5KeyTab /etc/http.keytab
+      KrbLocalUserMapping On
+      Require valid-user
+    </Location>
+
+The Require valid-user line can be replaced by
+
+    Require pam-account pam_service_name
+
+for example to run authorization check for the Kerberos-authenticated
+user using the PAM service pam_service_name.
+
+This can be useful to get for example host-based access control from
+an IPA server for the web service.
+
 On SELinux enabled systems, boolean allow_httpd_mod_auth_pam needs to
 be enabled:
 
diff --git a/mod_authnz_pam.c b/mod_authnz_pam.c
index 6ebc77e..08e687b 100644
--- a/mod_authnz_pam.c
+++ b/mod_authnz_pam.c
@@ -120,8 +120,36 @@ static const authn_provider authn_pam_provider = {
 	&pam_auth_account,
 };
 
+static int check_user_access(request_rec * r) {
+	int m = r->method_number;
+	const apr_array_header_t * reqs_arr = ap_requires(r);
+	if (! reqs_arr) {
+		return DECLINED;
+	}
+	require_line * reqs = (require_line *)reqs_arr->elts;
+	int x;
+	for (x = 0; x < reqs_arr->nelts; x++) {
+		if (!(reqs[x].method_mask & (AP_METHOD_BIT << m))) {
+			continue;
+		}
+		const char * t = reqs[x].requirement;
+		const char * w = ap_getword_white(r->pool, &t);
+		if (!strcasecmp(w, "pam-account")) {
+			const char * pam_service = ap_getword_conf(r->pool, &t);
+			if (pam_service && strlen(pam_service)) {
+				authn_status ret = pam_authenticate_with_login_password(r, pam_service, r->user, NULL, _PAM_STEP_ACCOUNT);
+				if (ret == AUTH_GRANTED) {
+					return OK;
+				}
+			}
+		}
+	}
+	return DECLINED;
+}
+
 static void register_hooks(apr_pool_t * p) {
 	ap_register_provider(p, AUTHN_PROVIDER_GROUP, "PAM", "0", &authn_pam_provider);
+	ap_hook_auth_checker(check_user_access, NULL, NULL, APR_HOOK_MIDDLE);
 }
 
 module AP_MODULE_DECLARE_DATA authnz_pam_module = {