diff options
Diffstat (limited to 'src/sss_client/pam_sss.c')
| -rw-r--r-- | src/sss_client/pam_sss.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c index abe9b0547..d64e826da 100644 --- a/src/sss_client/pam_sss.c +++ b/src/sss_client/pam_sss.c @@ -206,7 +206,7 @@ static size_t add_string_item(enum pam_item_type type, const char *str, return rp; } -static void overwrite_and_free_pam_items(struct pam_items *pi) +static void overwrite_and_free_authtoks(struct pam_items *pi) { if (pi->pam_authtok != NULL) { _pam_overwrite_n((void *)pi->pam_authtok, pi->pam_authtok_size); @@ -222,6 +222,11 @@ static void overwrite_and_free_pam_items(struct pam_items *pi) pi->pamstack_authtok = NULL; pi->pamstack_oldauthtok = NULL; +} + +static void overwrite_and_free_pam_items(struct pam_items *pi) +{ + overwrite_and_free_authtoks(pi); free(pi->domain_name); pi->domain_name = NULL; @@ -998,6 +1003,15 @@ static int eval_response(pam_handle_t *pamh, size_t buflen, uint8_t *buf, D(("do_pam_conversation failed.")); } break; + case SSS_OTP: + D(("OTP was used, removing authtokens.")); + overwrite_and_free_authtoks(pi); + ret = pam_set_item(pamh, PAM_AUTHTOK, NULL); + if (ret != PAM_SUCCESS) { + D(("Failed to remove PAM_AUTHTOK after using otp [%s]", + pam_strerror(pamh,ret))); + } + break; default: D(("Unknown response type [%d]", type)); } |