diff options
| author | Lukas Slebodnik <lslebodn@redhat.com> | 2014-05-26 18:31:06 +0200 |
|---|---|---|
| committer | Jakub Hrozek <jhrozek@redhat.com> | 2014-06-03 11:11:30 +0200 |
| commit | ffa42f689dded74b0c0b0451bff3516bc4003179 (patch) | |
| tree | 6cd4881173be79c1cf0bb2cffd93c45cb31af60b /src | |
| parent | 683e1f67d08be7165ea456d4594c4c8a4eddc9b3 (diff) | |
| download | sssd-ffa42f689dded74b0c0b0451bff3516bc4003179.tar.gz sssd-ffa42f689dded74b0c0b0451bff3516bc4003179.tar.xz sssd-ffa42f689dded74b0c0b0451bff3516bc4003179.zip | |
PAM: add ignore_authinfo_unavail option
Resolves:
https://fedorahosted.org/sssd/ticket/2232
Reviewed-by: Sumit Bose <sbose@redhat.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/man/pam_sss.8.xml | 14 | ||||
| -rw-r--r-- | src/sss_client/pam_sss.c | 11 |
2 files changed, 25 insertions, 0 deletions
diff --git a/src/man/pam_sss.8.xml b/src/man/pam_sss.8.xml index e42cb2d62..859d42eea 100644 --- a/src/man/pam_sss.8.xml +++ b/src/man/pam_sss.8.xml @@ -40,6 +40,9 @@ <arg choice='opt'> <replaceable>ignore_unknown_user</replaceable> </arg> + <arg choice='opt'> + <replaceable>ignore_authinfo_unavail</replaceable> + </arg> </cmdsynopsis> </refsynopsisdiv> @@ -116,6 +119,17 @@ the PAM framework to ignore this module.</para> </listitem> </varlistentry> + <varlistentry> + <term> + <option>ignore_authinfo_unavail</option> + </term> + <listitem> + <para> + Specifies that the PAM module should return PAM_IGNORE + if it cannot contact the SSSD daemon. This causes + the PAM framework to ignore this module.</para> + </listitem> + </varlistentry> </variablelist> </refsect1> diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index d4baa19b6..908ab128e 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -49,6 +49,7 @@ #define FLAGS_FORWARD_PASS (1 << 1) #define FLAGS_USE_AUTHTOK (1 << 2) #define FLAGS_IGNORE_UNKNOWN_USER (1 << 3) +#define FLAGS_IGNORE_AUTHINFO_UNAVAIL (1 << 4) #define PWEXP_FLAG "pam_sss:password_expired_flag" #define FD_DESTRUCTOR "pam_sss:fd_destructor" @@ -1309,6 +1310,8 @@ static void eval_argv(pam_handle_t *pamh, int argc, const char **argv, *quiet_mode = true; } else if (strcmp(*argv, "ignore_unknown_user") == 0) { *flags |= FLAGS_IGNORE_UNKNOWN_USER; + } else if (strcmp(*argv, "ignore_authinfo_unavail") == 0) { + *flags |= FLAGS_IGNORE_AUTHINFO_UNAVAIL; } else { logger(pamh, LOG_WARNING, "unknown option: %s", *argv); } @@ -1453,6 +1456,10 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh, if (flags & FLAGS_IGNORE_UNKNOWN_USER && ret == PAM_USER_UNKNOWN) { ret = PAM_IGNORE; } + if (flags & FLAGS_IGNORE_AUTHINFO_UNAVAIL + && ret == PAM_AUTHINFO_UNAVAIL) { + ret = PAM_IGNORE; + } return ret; } @@ -1495,6 +1502,10 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh, && pam_status == PAM_USER_UNKNOWN) { pam_status = PAM_IGNORE; } + if (flags & FLAGS_IGNORE_AUTHINFO_UNAVAIL + && pam_status == PAM_AUTHINFO_UNAVAIL) { + pam_status = PAM_IGNORE; + } switch (task) { case SSS_PAM_AUTHENTICATE: |