From a531a785f57be7ae228ca04a7af606debd66eeb1 Mon Sep 17 00:00:00 2001

From: Sumit Bose <sbose@redhat.com>

Date: Wed, 3 May 2017 16:30:12 +0200

Subject: [PATCH 158/160] PAM: send user name hint response when needed

MIME-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

If the PAM client didn't send a user name and promtusername is enable

the PAM responder will tell pam_sss to ask for an optional user name as

well.

Resolves:

https://pagure.io/SSSD/sssd/issue/3395

Reviewed-by: Fabiano Fidêncio <fidencio@redhat.com>

(cherry picked from commit 32474fa2f0a6dc09386bab405fc3461cb3dd12ac)

---

 src/responder/pam/pamsrv_cmd.c  |  72 ++++++++++------

 src/tests/cmocka/test_pam_srv.c | 180 +++++++++++++++++++++++++++++-----------

 2 files changed, 177 insertions(+), 75 deletions(-)

diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c

index 080cfafa709d63542fbf57d26fab11f0a367dea7..49a05657e03feef564d6196029da4cacc2ab8eaf 100644

--- a/src/responder/pam/pamsrv_cmd.c

+++ b/src/responder/pam/pamsrv_cmd.c

@@ -1414,7 +1414,7 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)

     struct cache_req_result **results;

     struct pam_auth_req *preq = tevent_req_callback_data(req,

                                                          struct pam_auth_req);

-    const char *cert_user;

+    const char *cert_user = NULL;

     ret = cache_req_recv(preq, req, &results);

     talloc_zfree(req);

@@ -1439,35 +1439,55 @@ static void pam_forwarder_lookup_by_cert_done(struct tevent_req *req)

                 goto done;

             }

-            if (preq->cert_user_objs->count != 1) {

-                DEBUG(SSSDBG_CRIT_FAILURE,

-                      "More than one user mapped to certificate.\n");

-                /* TODO: send pam response to ask for a user name */

-                ret = ERR_NO_CREDS;

-                goto done;

-            }

-            cert_user = ldb_msg_find_attr_as_string(

+            if (preq->cert_user_objs->count == 1) {

+                cert_user = ldb_msg_find_attr_as_string(

                                                   preq->cert_user_objs->msgs[0],

                                                   SYSDB_NAME, NULL);

+                if (cert_user == NULL) {

+                    DEBUG(SSSDBG_CRIT_FAILURE,

+                          "Certificate user object has not name.\n");

+                    ret = ENOENT;

+                    goto done;

+                }

+

+                DEBUG(SSSDBG_FUNC_DATA,

+                      "Found certificate user [%s].\n", cert_user);

+

+                ret = sss_parse_name_for_domains(preq->pd,

+                                               preq->cctx->rctx->domains,

+                                               preq->cctx->rctx->default_domain,

+                                               cert_user,

+                                               &preq->pd->domain,

+                                               &preq->pd->user);

+                if (ret != EOK) {

+                    DEBUG(SSSDBG_OP_FAILURE,

+                          "sss_parse_name_for_domains failed.\n");

+                    goto done;

+                }

+            }

+

+            if (preq->cctx->rctx->domains->user_name_hint) {

+                ret = add_pam_cert_response(preq->pd, cert_user,

+                                            preq->token_name,

+                                            preq->module_name,

+                                            preq->key_id,

+                                            SSS_PAM_CERT_INFO_WITH_HINT);

+                if (ret != EOK) {

+                    DEBUG(SSSDBG_OP_FAILURE, "add_pam_cert_response failed.\n");

+                    preq->pd->pam_status = PAM_AUTHINFO_UNAVAIL;

+                }

+                ret = EOK;

+                preq->pd->pam_status = PAM_SUCCESS;

+                pam_reply(preq);

+                goto done;

+            }

+

+            /* Without user name hints the certificate must map to single user

+             * if no login name was given */

             if (cert_user == NULL) {

                 DEBUG(SSSDBG_CRIT_FAILURE,

-                      "Certificate user object has not name.\n");

-                ret = ENOENT;

-                goto done;

-            }

-

-            DEBUG(SSSDBG_FUNC_DATA, "Found certificate user [%s].\n",

-                                    cert_user);

-

-            ret = sss_parse_name_for_domains(preq->pd,

-                                             preq->cctx->rctx->domains,

-                                             preq->cctx->rctx->default_domain,

-                                             cert_user,

-                                             &preq->pd->domain,

-                                             &preq->pd->user);

-            if (ret != EOK) {

-                DEBUG(SSSDBG_OP_FAILURE,

-                      "sss_parse_name_for_domains failed.\n");

+                      "More than one user mapped to certificate.\n");

+                ret = ERR_NO_CREDS;

                 goto done;

             }

diff --git a/src/tests/cmocka/test_pam_srv.c b/src/tests/cmocka/test_pam_srv.c

index 35afbdd81d004236885ee80914771ccb4b8acff4..0f92f05417025e41a702127099d1d01e269412dc 100644

--- a/src/tests/cmocka/test_pam_srv.c

+++ b/src/tests/cmocka/test_pam_srv.c

@@ -747,57 +747,83 @@ static int test_pam_cert_check_gdm_smartcard(uint32_t status, uint8_t *body,

     return EOK;

 }

+static int test_pam_cert_check_ex(uint32_t status, uint8_t *body, size_t blen,

+                                  enum response_type type, const char *name)

+{

+    size_t rp = 0;

+    uint32_t val;

+

+    assert_int_equal(status, 0);

+

+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+    assert_int_equal(val, pam_test_ctx->exp_pam_status);

+

+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+    if (name == NULL || *name == '\0') {

+        assert_int_equal(val, 1);

+    } else {

+        assert_int_equal(val, 2);

+

+        SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+        assert_int_equal(val, SSS_PAM_DOMAIN_NAME);

+

+        SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+        assert_int_equal(val, 9);

+

+        assert_int_equal(*(body + rp + val - 1), 0);

+        assert_string_equal(body + rp, TEST_DOM_NAME);

+        rp += val;

+    }

+

+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+    assert_int_equal(val, type);

+

+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

+    assert_int_equal(val, (strlen(name) + 1

+                                + sizeof(TEST_TOKEN_NAME)

+                                + sizeof(TEST_MODULE_NAME)

+                                + sizeof(TEST_KEY_ID)));

+

+    assert_int_equal(*(body + rp + strlen(name)), 0);

+    assert_string_equal(body + rp, name);

+    rp += strlen(name) + 1;

+

+    assert_int_equal(*(body + rp + sizeof(TEST_TOKEN_NAME) - 1), 0);

+    assert_string_equal(body + rp, TEST_TOKEN_NAME);

+    rp += sizeof(TEST_TOKEN_NAME);

+

+    assert_int_equal(*(body + rp + sizeof(TEST_MODULE_NAME) - 1), 0);

+    assert_string_equal(body + rp, TEST_MODULE_NAME);

+    rp += sizeof(TEST_MODULE_NAME);

+

+    assert_int_equal(*(body + rp + sizeof(TEST_KEY_ID) - 1), 0);

+    assert_string_equal(body + rp, TEST_KEY_ID);

+    rp += sizeof(TEST_KEY_ID);

+

+    assert_int_equal(rp, blen);

+

+    return EOK;

+}

+

 static int test_pam_cert_check(uint32_t status, uint8_t *body, size_t blen)

 {

-    size_t rp = 0;

-    uint32_t val;

-

-    assert_int_equal(status, 0);

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, pam_test_ctx->exp_pam_status);

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, 2);

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, SSS_PAM_DOMAIN_NAME);

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, 9);

-

-    assert_int_equal(*(body + rp + val - 1), 0);

-    assert_string_equal(body + rp, TEST_DOM_NAME);

-    rp += val;

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, SSS_PAM_CERT_INFO);

-

-    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);

-    assert_int_equal(val, (sizeof("pamuser@"TEST_DOM_NAME)

-                                + sizeof(TEST_TOKEN_NAME)

-                                + sizeof(TEST_MODULE_NAME)

-                                + sizeof(TEST_KEY_ID)));

-

-    assert_int_equal(*(body + rp + sizeof("pamuser@"TEST_DOM_NAME) - 1), 0);

-    assert_string_equal(body + rp, "pamuser@"TEST_DOM_NAME);

-    rp += sizeof("pamuser@"TEST_DOM_NAME);

-

-    assert_int_equal(*(body + rp + sizeof(TEST_TOKEN_NAME) - 1), 0);

-    assert_string_equal(body + rp, TEST_TOKEN_NAME);

-    rp += sizeof(TEST_TOKEN_NAME);

-

-    assert_int_equal(*(body + rp + sizeof(TEST_MODULE_NAME) - 1), 0);

-    assert_string_equal(body + rp, TEST_MODULE_NAME);

-    rp += sizeof(TEST_MODULE_NAME);

-

-    assert_int_equal(*(body + rp + sizeof(TEST_KEY_ID) - 1), 0);

-    assert_string_equal(body + rp, TEST_KEY_ID);

-    rp += sizeof(TEST_KEY_ID);

-

-    assert_int_equal(rp, blen);

-

-    return EOK;

+    return test_pam_cert_check_ex(status, body, blen,

+                                  SSS_PAM_CERT_INFO, "pamuser@"TEST_DOM_NAME);

+}

+

+static int test_pam_cert_check_with_hint(uint32_t status, uint8_t *body,

+                                         size_t blen)

+{

+    return test_pam_cert_check_ex(status, body, blen,

+                                  SSS_PAM_CERT_INFO_WITH_HINT,

+                                  "pamuser@"TEST_DOM_NAME);

+}

+

+static int test_pam_cert_check_with_hint_no_user(uint32_t status, uint8_t *body,

+                                                 size_t blen)

+{

+    return test_pam_cert_check_ex(status, body, blen,

+                                  SSS_PAM_CERT_INFO_WITH_HINT, "");

 }

 static int test_pam_offline_chauthtok_check(uint32_t status,

@@ -1895,6 +1921,33 @@ void test_pam_preauth_cert_no_logon_name(void **state)

     assert_int_equal(ret, EOK);

 }

+void test_pam_preauth_cert_no_logon_name_with_hint(void **state)

+{

+    int ret;

+

+    set_cert_auth_param(pam_test_ctx->pctx, NSS_DB);

+    pam_test_ctx->rctx->domains->user_name_hint = true;

+

+    /* If no logon name is given the user is looked by certificate first.

+     * Since user name hint is enabled we do not have to search the user

+     * during pre-auth and there is no need for an extra mocked response as in

+     * test_pam_preauth_cert_no_logon_name. */

+    mock_input_pam_cert(pam_test_ctx, NULL, NULL, NULL,

+                        test_lookup_by_cert_cb, TEST_TOKEN_CERT, false);

+

+    will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

+

+    set_cmd_cb(test_pam_cert_check_with_hint);

+    ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

+                          pam_test_ctx->pam_cmds);

+    assert_int_equal(ret, EOK);

+

+    /* Wait until the test finishes with EOK */

+    ret = test_ev_loop(pam_test_ctx->tctx);

+    assert_int_equal(ret, EOK);

+}

+

 void test_pam_preauth_cert_no_logon_name_double_cert(void **state)

 {

     int ret;

@@ -1917,6 +1970,29 @@ void test_pam_preauth_cert_no_logon_name_double_cert(void **state)

     assert_int_equal(ret, EOK);

 }

+void test_pam_preauth_cert_no_logon_name_double_cert_with_hint(void **state)

+{

+    int ret;

+

+    set_cert_auth_param(pam_test_ctx->pctx, NSS_DB);

+    pam_test_ctx->rctx->domains->user_name_hint = true;

+

+    mock_input_pam_cert(pam_test_ctx, NULL, NULL, NULL,

+                        test_lookup_by_cert_double_cb, TEST_TOKEN_CERT, false);

+

+    will_return(__wrap_sss_packet_get_cmd, SSS_PAM_PREAUTH);

+    will_return(__wrap_sss_packet_get_body, WRAP_CALL_REAL);

+

+    set_cmd_cb(test_pam_cert_check_with_hint_no_user);

+    ret = sss_cmd_execute(pam_test_ctx->cctx, SSS_PAM_PREAUTH,

+                          pam_test_ctx->pam_cmds);

+    assert_int_equal(ret, EOK);

+

+    /* Wait until the test finishes with EOK */

+    ret = test_ev_loop(pam_test_ctx->tctx);

+    assert_int_equal(ret, EOK);

+}

+

 void test_pam_preauth_no_cert_no_logon_name(void **state)

 {

     int ret;

@@ -2426,8 +2502,14 @@ int main(int argc, const char *argv[])

         cmocka_unit_test_setup_teardown(test_pam_preauth_cert_no_logon_name,

                                         pam_test_setup, pam_test_teardown),

         cmocka_unit_test_setup_teardown(

+                                  test_pam_preauth_cert_no_logon_name_with_hint,

+                                  pam_test_setup, pam_test_teardown),

+        cmocka_unit_test_setup_teardown(

                                 test_pam_preauth_cert_no_logon_name_double_cert,

                                 pam_test_setup, pam_test_teardown),

+        cmocka_unit_test_setup_teardown(

+                      test_pam_preauth_cert_no_logon_name_double_cert_with_hint,

+                      pam_test_setup, pam_test_teardown),

         cmocka_unit_test_setup_teardown(test_pam_preauth_no_cert_no_logon_name,

                                         pam_test_setup, pam_test_teardown),

         cmocka_unit_test_setup_teardown(

-- 

2.9.4