|
 |
b2d430 |
From b5a092b4b0e4f072f0f402146a83addb97cf2977 Mon Sep 17 00:00:00 2001
|
|
|
b2d430 |
From: Sumit Bose <sbose@redhat.com>
|
|
|
b2d430 |
Date: Fri, 16 Sep 2016 11:48:18 +0200
|
|
|
b2d430 |
Subject: [PATCH 143/143] pam_sss: check PKCS11_LOGIN_TOKEN_NAME
|
|
|
b2d430 |
|
|
|
b2d430 |
Check if PKCS11_LOGIN_TOKEN_NAME is set and prompt the user if the
|
|
|
b2d430 |
matching Smartcard is not inserted.
|
|
|
b2d430 |
|
|
|
b2d430 |
Related to https://fedorahosted.org/sssd/ticket/3165
|
|
|
b2d430 |
|
|
|
b2d430 |
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
|
|
|
b2d430 |
(cherry picked from commit 35ba922bc51416f02877b53a6f25c04104ae5f03)
|
|
|
b2d430 |
---
|
|
|
b2d430 |
src/sss_client/pam_sss.c | 65 ++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
b2d430 |
1 file changed, 65 insertions(+)
|
|
|
b2d430 |
|
|
|
b2d430 |
diff --git a/src/sss_client/pam_sss.c b/src/sss_client/pam_sss.c
|
|
|
b2d430 |
index fdb9c907644f1317b6f8e58619f01ad2753deafc..2049d5fb0c6092aaaa914385c79d02d8f44b447e 100644
|
|
|
b2d430 |
--- a/src/sss_client/pam_sss.c
|
|
|
b2d430 |
+++ b/src/sss_client/pam_sss.c
|
|
|
b2d430 |
@@ -1410,6 +1410,7 @@ done:
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
#define SC_PROMPT_FMT "PIN for %s for user %s"
|
|
|
b2d430 |
+
|
|
|
b2d430 |
static int prompt_sc_pin(pam_handle_t *pamh, struct pam_items *pi)
|
|
|
b2d430 |
{
|
|
|
b2d430 |
int ret;
|
|
|
b2d430 |
@@ -1691,6 +1692,62 @@ static int get_authtok_for_password_change(pam_handle_t *pamh,
|
|
|
b2d430 |
return PAM_SUCCESS;
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
+#define SC_ENTER_FMT "Please enter smart card labeled\n %s\nand press enter"
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+static int check_login_token_name(pam_handle_t *pamh, struct pam_items *pi,
|
|
|
b2d430 |
+ bool quiet_mode)
|
|
|
b2d430 |
+{
|
|
|
b2d430 |
+ int ret;
|
|
|
b2d430 |
+ int pam_status;
|
|
|
b2d430 |
+ char *login_token_name;
|
|
|
b2d430 |
+ char *prompt = NULL;
|
|
|
b2d430 |
+ size_t size;
|
|
|
b2d430 |
+ char *answer = NULL;
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ login_token_name = getenv("PKCS11_LOGIN_TOKEN_NAME");
|
|
|
b2d430 |
+ if (login_token_name == NULL) {
|
|
|
b2d430 |
+ return PAM_SUCCESS;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ while (pi->token_name == NULL
|
|
|
b2d430 |
+ || strcmp(login_token_name, pi->token_name) != 0) {
|
|
|
b2d430 |
+ size = sizeof(SC_ENTER_FMT) + strlen(login_token_name);
|
|
|
b2d430 |
+ prompt = malloc(size);
|
|
|
b2d430 |
+ if (prompt == NULL) {
|
|
|
b2d430 |
+ D(("malloc failed."));
|
|
|
b2d430 |
+ return ENOMEM;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ ret = snprintf(prompt, size, SC_ENTER_FMT,
|
|
|
b2d430 |
+ login_token_name);
|
|
|
b2d430 |
+ if (ret < 0 || ret >= size) {
|
|
|
b2d430 |
+ D(("snprintf failed."));
|
|
|
b2d430 |
+ free(prompt);
|
|
|
b2d430 |
+ return EFAULT;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ ret = do_pam_conversation(pamh, PAM_PROMPT_ECHO_OFF, prompt,
|
|
|
b2d430 |
+ NULL, &answer);
|
|
|
b2d430 |
+ free(prompt);
|
|
|
b2d430 |
+ free(answer);
|
|
|
b2d430 |
+ if (ret != PAM_SUCCESS) {
|
|
|
b2d430 |
+ D(("do_pam_conversation failed."));
|
|
|
b2d430 |
+ return ret;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ pam_status = send_and_receive(pamh, pi, SSS_PAM_PREAUTH, quiet_mode);
|
|
|
b2d430 |
+ if (pam_status != PAM_SUCCESS) {
|
|
|
b2d430 |
+ D(("send_and_receive returned [%d] during pre-auth", pam_status));
|
|
|
b2d430 |
+ /*
|
|
|
b2d430 |
+ * Since we are waiting for the right Smartcard to be inserted errors
|
|
|
b2d430 |
+ * can be ignored here.
|
|
|
b2d430 |
+ */
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
+ return PAM_SUCCESS;
|
|
|
b2d430 |
+}
|
|
|
b2d430 |
+
|
|
|
b2d430 |
static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
|
|
|
b2d430 |
int pam_flags, int argc, const char **argv)
|
|
|
b2d430 |
{
|
|
|
b2d430 |
@@ -1758,6 +1815,14 @@ static int pam_sss(enum sss_cli_command task, pam_handle_t *pamh,
|
|
|
b2d430 |
}
|
|
|
b2d430 |
}
|
|
|
b2d430 |
|
|
|
b2d430 |
+ if (strcmp(pi.pam_service, "gdm-smartcard") == 0) {
|
|
|
b2d430 |
+ ret = check_login_token_name(pamh, &pi, quiet_mode);
|
|
|
b2d430 |
+ if (ret != PAM_SUCCESS) {
|
|
|
b2d430 |
+ D(("check_login_token_name failed.\n"));
|
|
|
b2d430 |
+ return ret;
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+ }
|
|
|
b2d430 |
+
|
|
|
b2d430 |
ret = get_authtok_for_authentication(pamh, &pi, flags);
|
|
|
b2d430 |
if (ret != PAM_SUCCESS) {
|
|
|
b2d430 |
D(("failed to get authentication token: %s",
|
|
|
b2d430 |
--
|
|
|
b2d430 |
2.7.4
|
|
|
b2d430 |
|