PAM: Pass account lockout status and display message

Tested against Windows Server 2012.

Resolves:
https://fedorahosted.org/sssd/ticket/2839

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/src/providers/dp_auth_util.c b/src/providers/dp_auth_util.c
index f8a30c5d4..8e261ef5e 100644
--- a/src/providers/dp_auth_util.c
+++ b/src/providers/dp_auth_util.c
@@ -160,6 +160,14 @@ bool dp_pack_pam_response(DBusMessage *msg, struct pam_data *pd)
         return false;
     }
 
+    /* Append the lockout of account */
+    dbret = dbus_message_iter_append_basic(&iter,
+                                           DBUS_TYPE_UINT32,
+                                           &pd->account_locked);
+    if (!dbret) {
+        return false;
+    }
+
     /* Create an array of response structures */
     dbret = dbus_message_iter_open_container(&iter,
                                              DBUS_TYPE_ARRAY, "(uay)",
@@ -246,6 +254,17 @@ bool dp_unpack_pam_response(DBusMessage *msg, struct pam_data *pd, DBusError *db
         return false;
     }
 
+    if (dbus_message_iter_get_arg_type(&iter) != DBUS_TYPE_UINT32) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "pam response format error.\n");
+        return false;
+    }
+    dbus_message_iter_get_basic(&iter, &(pd->account_locked));
+
+    if (!dbus_message_iter_next(&iter)) {
+        DEBUG(SSSDBG_CRIT_FAILURE, "pam response has too few arguments.\n");
+        return false;
+    }
+
     /* After this point will be an array of pam data */
     if (dbus_message_iter_get_arg_type(&iter) != DBUS_TYPE_ARRAY) {
         DEBUG(SSSDBG_CRIT_FAILURE, "pam response format error.\n");