148 lines
3.5 KiB
C
148 lines
3.5 KiB
C
/*
|
|
* CDE - Common Desktop Environment
|
|
*
|
|
* Copyright (c) 1993-2012, The Open Group. All rights reserved.
|
|
*
|
|
* These libraries and programs are free software; you can
|
|
* redistribute them and/or modify them under the terms of the GNU
|
|
* Lesser General Public License as published by the Free Software
|
|
* Foundation; either version 2 of the License, or (at your option)
|
|
* any later version.
|
|
*
|
|
* These libraries and programs are distributed in the hope that
|
|
* they will be useful, but WITHOUT ANY WARRANTY; without even the
|
|
* implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
|
|
* PURPOSE. See the GNU Lesser General Public License for more
|
|
* details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with these libraries and programs; if not, write
|
|
* to the Free Software Foundation, Inc., 51 Franklin Street, Fifth
|
|
* Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
/* $XConsortium: dce_setcred.c /main/5 1996/05/09 04:27:17 drk $ */
|
|
|
|
/*
|
|
* Copyright (c) 1992-1995, by Sun Microsystems, Inc.
|
|
* All rights reserved.
|
|
*/
|
|
|
|
#ident "@(#)dce_setcred.c 1.21 96/01/11 SMI"
|
|
|
|
#include <libintl.h>
|
|
#include <security/pam_appl.h>
|
|
#include <security/pam_modules.h>
|
|
#include <dce/sec_login.h>
|
|
#include <dce/dce_error.h>
|
|
#include <string.h>
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <sys/types.h>
|
|
#include <syslog.h>
|
|
#include <libintl.h>
|
|
|
|
#include "pam_impl.h"
|
|
#include "utils.h"
|
|
|
|
static void
|
|
do_cred_warn(void *pamh)
|
|
{
|
|
char messages[1][PAM_MAX_MSG_SIZE];
|
|
|
|
sprintf(messages[0],
|
|
PAM_MSG(pamh, 30, "warning: Unable to obtain DCE credentials.\n"));
|
|
|
|
(void) __pam_display_msg(pamh, PAM_ERROR_MSG, 1, messages, NULL);
|
|
}
|
|
|
|
/*
|
|
* pam_sm_setcred
|
|
*/
|
|
int
|
|
pam_sm_setcred(
|
|
pam_handle_t *pamh,
|
|
int flags,
|
|
int argc,
|
|
const char **argv)
|
|
{
|
|
int debug = 0;
|
|
int warn = 1;
|
|
int i;
|
|
dce_module_data_t *dsd;
|
|
error_status_t st;
|
|
int err;
|
|
|
|
for (i = 0; i < argc; i++) {
|
|
if (strcmp(argv[i], "debug") == 0)
|
|
debug = 1;
|
|
if (strcmp(argv[i], "nowarn") == 0)
|
|
warn = 0;
|
|
}
|
|
|
|
if (flags & PAM_SILENT) warn = 0;
|
|
|
|
if (debug)
|
|
syslog(LOG_DEBUG, "DCE pam_setcred");
|
|
|
|
if (pam_get_data(pamh, DCE_DATA, (void**)&dsd) != PAM_SUCCESS ||
|
|
dsd == NULL) {
|
|
if (flags & PAM_DELETE_CRED) {
|
|
sec_login_handle_t context;
|
|
|
|
/* attempt to get current context and purge */
|
|
sec_login_get_current_context(&context, &st);
|
|
if (st == error_status_ok) {
|
|
sec_login_purge_context(&context, &st);
|
|
}
|
|
return (st == error_status_ok ? PAM_SUCCESS :
|
|
PAM_CRED_UNAVAIL);
|
|
}
|
|
|
|
if (warn) do_cred_warn(pamh);
|
|
return (PAM_IGNORE); /* since pam_auth was never called */
|
|
}
|
|
|
|
if (dsd->auth_status != PAM_SUCCESS)
|
|
return (dsd->auth_status);
|
|
|
|
if (flags & PAM_DELETE_CRED) {
|
|
(void) sec_login_purge_context(dsd->login_context, &st);
|
|
|
|
if (debug) {
|
|
dce_error_string_t text;
|
|
|
|
syslog(LOG_DEBUG,
|
|
"PAM: DCE sec_login_purge_context: %s",
|
|
get_dce_error_message(st, text));
|
|
}
|
|
|
|
} else {
|
|
if (dsd->auth_src == sec_login_auth_src_local) {
|
|
/* we can't set_context on locally authenticated */
|
|
/* contexts */
|
|
st = sec_login_s_auth_local;
|
|
} else {
|
|
(void) sec_login_set_context(dsd->login_context, &st);
|
|
}
|
|
|
|
if (debug) {
|
|
dce_error_string_t text;
|
|
|
|
syslog(LOG_DEBUG, "PAM: DCE sec_login_set_context: %s",
|
|
get_dce_error_message(st, text));
|
|
}
|
|
}
|
|
|
|
/* might want an option to return success even if set_context failed */
|
|
|
|
if (st == error_status_ok) {
|
|
return (PAM_SUCCESS);
|
|
} else {
|
|
if (warn) do_cred_warn(pamh);
|
|
|
|
if (debug) syslog(LOG_DEBUG,
|
|
"Can't set user login context");
|
|
return (PAM_CRED_ERR);
|
|
}
|
|
}
|