From 4dd996dad753182ae62132fcfd2a8518e57836d4 Mon Sep 17 00:00:00 2001 From: Jakub Hrozek Date: Wed, 7 Nov 2012 18:28:29 +0100 Subject: Do not always return PAM_SYSTEM_ERR when offline krb5 authentication fails --- src/providers/krb5/krb5_auth.c | 3 ++- src/responder/pam/pamsrv_cmd.c | 29 ++++++++++++----------------- src/util/auth_utils.h | 42 ++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 56 insertions(+), 18 deletions(-) create mode 100644 src/util/auth_utils.h (limited to 'src') diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c index 83dcfae82..82d8ecc2b 100644 --- a/src/providers/krb5/krb5_auth.c +++ b/src/providers/krb5/krb5_auth.c @@ -34,6 +34,7 @@ #include "util/util.h" #include "util/find_uid.h" +#include "util/auth_utils.h" #include "db/sysdb.h" #include "util/child_common.h" #include "providers/krb5/krb5_auth.h" @@ -1132,7 +1133,7 @@ static void krb5_pam_handler_cache_auth_step(struct tevent_req *req) NULL); if (ret != EOK) { DEBUG(1, ("Offline authentication failed\n")); - state->pam_status = PAM_SYSTEM_ERR; + state->pam_status = cached_login_pam_status(ret); state->dp_err = DP_ERR_OK; } else { ret = add_user_to_delayed_online_authentication(krb5_ctx, pd, diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c index bf5114870..2a56aecfa 100644 --- a/src/responder/pam/pamsrv_cmd.c +++ b/src/responder/pam/pamsrv_cmd.c @@ -23,6 +23,7 @@ #include #include "util/util.h" #include "util/sss_selinux.h" +#include "util/auth_utils.h" #include "db/sysdb.h" #include "confdb/confdb.h" #include "responder/common/responder_packet.h" @@ -616,8 +617,8 @@ static void pam_reply_delay(struct tevent_context *ev, struct tevent_timer *te, pam_reply(preq); } -static void pam_cache_auth_done(struct pam_auth_req *preq, int ret, - time_t expire_date, time_t delayed_until); +static void pam_handle_cached_login(struct pam_auth_req *preq, int ret, + time_t expire_date, time_t delayed_until); static void pam_reply(struct pam_auth_req *preq) { @@ -668,7 +669,7 @@ static void pam_reply(struct pam_auth_req *preq) pctx->rctx->cdb, false, &exp_date, &delay_until); - pam_cache_auth_done(preq, ret, exp_date, delay_until); + pam_handle_cached_login(preq, ret, exp_date, delay_until); return; } break; @@ -811,18 +812,18 @@ done: sss_cmd_done(cctx, preq); } -static void pam_cache_auth_done(struct pam_auth_req *preq, int ret, - time_t expire_date, time_t delayed_until) +static void pam_handle_cached_login(struct pam_auth_req *preq, int ret, + time_t expire_date, time_t delayed_until) { uint32_t resp_type; size_t resp_len; uint8_t *resp; int64_t dummy; - switch (ret) { - case EOK: - preq->pd->pam_status = PAM_SUCCESS; + preq->pd->pam_status = cached_login_pam_status(ret); + switch (preq->pd->pam_status) { + case PAM_SUCCESS: resp_type = SSS_PAM_USER_INFO_OFFLINE_AUTH; resp_len = sizeof(uint32_t) + sizeof(int64_t); resp = talloc_size(preq->pd, resp_len); @@ -839,14 +840,7 @@ static void pam_cache_auth_done(struct pam_auth_req *preq, int ret, } } break; - case ENOENT: - preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL; - break; - case EINVAL: - preq->pd->pam_status = PAM_AUTH_ERR; - break; - case EACCES: - preq->pd->pam_status = PAM_PERM_DENIED; + case PAM_PERM_DENIED: if (delayed_until >= 0) { resp_type = SSS_PAM_USER_INFO_OFFLINE_AUTH_DELAYED; resp_len = sizeof(uint32_t) + sizeof(int64_t); @@ -866,7 +860,8 @@ static void pam_cache_auth_done(struct pam_auth_req *preq, int ret, } break; default: - preq->pd->pam_status = PAM_SYSTEM_ERR; + DEBUG(SSSDBG_TRACE_LIBS, + ("cached login returned: %d\n", preq->pd->pam_status)); } pam_reply(preq); diff --git a/src/util/auth_utils.h b/src/util/auth_utils.h new file mode 100644 index 000000000..e9e60a085 --- /dev/null +++ b/src/util/auth_utils.h @@ -0,0 +1,42 @@ +/* + SSSD + + Authentication utility functions + + Authors: + Jakub Hrozek + + Copyright (C) 2012 Red Hat + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see . +*/ + +#include +#include + +static inline int cached_login_pam_status(int auth_res) +{ + switch (auth_res) { + case EOK: + return PAM_SUCCESS; + case ENOENT: + return PAM_AUTHINFO_UNAVAIL; + case EINVAL: + return PAM_AUTH_ERR; + case EACCES: + return PAM_PERM_DENIED; + } + + return PAM_SYSTEM_ERR; +} -- cgit