From 23dc20cd69cfbb2731c36e1610536ba190bbd459 Mon Sep 17 00:00:00 2001 From: Sumit Bose Date: Wed, 16 Dec 2009 12:53:55 +0100 Subject: Handle chauthtok with PAM_PRELIM_CHECK separately If pam_sm_chauthtok is called with the flag PAM_PRELIM_CHECK set we generate a separate call to the sssd to validate the old password before asking for a new password and sending the change password request. --- server/providers/proxy.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) (limited to 'server/providers/proxy.c') diff --git a/server/providers/proxy.c b/server/providers/proxy.c index ef52ae91e..080479c4c 100644 --- a/server/providers/proxy.c +++ b/server/providers/proxy.c @@ -137,6 +137,7 @@ static void proxy_pam_handler(struct be_req *req) { struct proxy_auth_ctx); break; case SSS_PAM_CHAUTHTOK: + case SSS_PAM_CHAUTHTOK_PRELIM: ctx = talloc_get_type(req->be_ctx->bet_info[BET_CHPASS].pvt_bet_data, struct proxy_auth_ctx); break; @@ -207,12 +208,22 @@ static void proxy_pam_handler(struct be_req *req) { cache_auth_data = true; } break; + case SSS_PAM_CHAUTHTOK_PRELIM: + if (pd->priv != 1) { + auth_data->authtok_size = pd->authtok_size; + auth_data->authtok = pd->authtok; + pam_status = pam_authenticate(pamh, 0); + } else { + pam_status = PAM_SUCCESS; + } + break; default: DEBUG(1, ("unknown PAM call")); pam_status=PAM_ABORT; } - DEBUG(4, ("Pam result: [%d][%s]\n", pam_status, pam_strerror(pamh, pam_status))); + DEBUG(4, ("Pam result: [%d][%s]\n", pam_status, + pam_strerror(pamh, pam_status))); if (pam_status == PAM_AUTHINFO_UNAVAIL) { be_mark_offline(req->be_ctx); -- cgit