|
 |
b2d430 |
From d8c0b5421934cae887a44be42250d5df5631d3de Mon Sep 17 00:00:00 2001
|
|
|
b2d430 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
b2d430 |
Date: Wed, 22 Jun 2016 18:21:11 +0200
|
|
|
b2d430 |
Subject: [PATCH 58/62] PAM: continue with UPN/email search if name was not
|
|
|
b2d430 |
found
|
|
|
b2d430 |
|
|
|
b2d430 |
Currently we only search for UPNs if the domain part of the name was not
|
|
|
b2d430 |
know, with Kerberos aliases and email addresses we have to do this even
|
|
|
b2d430 |
if the domain name is a know domain.
|
|
|
b2d430 |
|
|
|
b2d430 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
b2d430 |
(cherry picked from commit 3381d9736b698d6111d10e219a0b5b898a4c757c)
|
|
|
b2d430 |
---
|
|
|
b2d430 |
src/responder/pam/pamsrv_cmd.c | 39 +++++++++++++++++++++++++++++++++++++++
|
|
|
b2d430 |
1 file changed, 39 insertions(+)
|
|
|
b2d430 |
|
|
|
b2d430 |
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
|
|
|
b2d430 |
index 3a35c3f08821aa23051989599d45b8b7b0677da4..1c759f009321cbb322fce624b506ed07f93f997b 100644
|
|
|
b2d430 |
--- a/src/responder/pam/pamsrv_cmd.c
|
|
|
b2d430 |
+++ b/src/responder/pam/pamsrv_cmd.c
|
|
|
b2d430 |
@@ -924,6 +924,39 @@ static void pam_check_user_dp_callback(uint16_t err_maj, uint32_t err_min,
|
|
|
b2d430 |
static int pam_check_user_search(struct pam_auth_req *preq);
|
|
|
b2d430 |
static int pam_check_user_done(struct pam_auth_req *preq, int ret);
|
|
|
b2d430 |
|
|
|
b2d430 |
+static errno_t pam_cmd_assume_upn(struct pam_auth_req *preq)
|
|
|
b2d430 |
+{
|
|
|
b2d430 |
+ int ret;
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ if (!preq->pd->name_is_upn
|
|
|
b2d430 |
+ && preq->pd->logon_name != NULL
|
|
|
b2d430 |
+ && strchr(preq->pd->logon_name, '@') != NULL) {
|
|
|
b2d430 |
+ DEBUG(SSSDBG_TRACE_ALL,
|
|
|
b2d430 |
+ "No entry found so far, trying UPN/email lookup with [%s].\n",
|
|
|
b2d430 |
+ preq->pd->logon_name);
|
|
|
b2d430 |
+ /* Assuming Kerberos principal */
|
|
|
b2d430 |
+ preq->domain = preq->cctx->rctx->domains;
|
|
|
b2d430 |
+ preq->check_provider =
|
|
|
b2d430 |
+ NEED_CHECK_PROVIDER(preq->domain->provider);
|
|
|
b2d430 |
+ preq->pd->user = talloc_strdup(preq->pd, preq->pd->logon_name);
|
|
|
b2d430 |
+ if (preq->pd->user == NULL) {
|
|
|
b2d430 |
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_strdup failed.\n");
|
|
|
b2d430 |
+ return ENOMEM;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+ preq->pd->name_is_upn = true;
|
|
|
b2d430 |
+ preq->pd->domain = NULL;
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ ret = pam_check_user_search(preq);
|
|
|
b2d430 |
+ if (ret == EOK) {
|
|
|
b2d430 |
+ pam_dom_forwarder(preq);
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+ return EOK;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ return ENOENT;
|
|
|
b2d430 |
+}
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+
|
|
|
b2d430 |
/* TODO: we should probably return some sort of cookie that is set in the
|
|
|
b2d430 |
* PAM_ENVIRONMENT, so that we can save performing some calls and cache
|
|
|
b2d430 |
* data. */
|
|
|
b2d430 |
@@ -1220,6 +1253,8 @@ static int pam_forwarder(struct cli_ctx *cctx, int pam_cmd)
|
|
|
b2d430 |
ret = pam_check_user_search(preq);
|
|
|
b2d430 |
if (ret == EOK) {
|
|
|
b2d430 |
pam_dom_forwarder(preq);
|
|
|
b2d430 |
+ } else if (ret == ENOENT) {
|
|
|
b2d430 |
+ ret = pam_cmd_assume_upn(preq);
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
done:
|
|
|
b2d430 |
@@ -1417,6 +1452,8 @@ static void pam_forwarder_cb(struct tevent_req *req)
|
|
|
b2d430 |
ret = pam_check_user_search(preq);
|
|
|
b2d430 |
if (ret == EOK) {
|
|
|
b2d430 |
pam_dom_forwarder(preq);
|
|
|
b2d430 |
+ } else if (ret == ENOENT) {
|
|
|
b2d430 |
+ ret = pam_cmd_assume_upn(preq);
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
done:
|
|
|
b2d430 |
@@ -1694,6 +1731,8 @@ static void pam_check_user_dp_callback(uint16_t err_maj, uint32_t err_min,
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
pam_dom_forwarder(preq);
|
|
|
b2d430 |
+ } else if (ret == ENOENT) {
|
|
|
b2d430 |
+ ret = pam_cmd_assume_upn(preq);
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
ret = pam_check_user_done(preq, ret);
|
|
|
b2d430 |
--
|
|
|
b2d430 |
2.4.11
|
|
|
b2d430 |
|