mirror of
https://github.com/samba-team/samba.git
synced 2024-12-25 23:21:54 +03:00
ed389ee8dc
This adds code to do generic PAM -> NTSTATUS and NTSTATUS -> PAM error
conversions, and uses them to make the error handling in pam_winbind sane.
In particular, pam_winbind now uses PAM error codes, not silly '-1, -2 ...'
stuff, and logs the NTSTATUS error that winbind now sends over the pipe.
Added code to wbinfo to display these - makes a big difference in debugging
winbindd.
The main change here is the code to allow pam_winbind password changing to
correctly stack - This code ripped from pam_unix, and the copyright attached.
(Same as for all pam modules, including pam_winbind)
Andrew Bartlett
(This used to be commit dc1a72f896)
95 lines
2.4 KiB
C
95 lines
2.4 KiB
C
/* pam_winbind header file
|
|
(Solaris needs some macros from Linux for common PAM code)
|
|
|
|
Shirish Kalele 2000
|
|
*/
|
|
|
|
#ifdef HAVE_FEATURES_H
|
|
#include <features.h>
|
|
#endif
|
|
|
|
#include <stdlib.h>
|
|
#include <unistd.h>
|
|
#include <string.h>
|
|
#include <syslog.h>
|
|
#include <stdarg.h>
|
|
#include <sys/types.h>
|
|
#include <sys/stat.h>
|
|
#include <fcntl.h>
|
|
#include <errno.h>
|
|
|
|
#include <config.h>
|
|
|
|
#define MODULE_NAME "pam_winbind"
|
|
#define PAM_SM_AUTH
|
|
#define PAM_SM_ACCOUNT
|
|
#define PAM_SM_PASSWORD
|
|
|
|
#if defined(SUNOS5) || defined(SUNOS4)
|
|
|
|
/* Solaris always uses dynamic pam modules */
|
|
#define PAM_EXTERN extern
|
|
#include <security/pam_appl.h>
|
|
|
|
#define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_RECOVERY_ERR
|
|
#endif
|
|
|
|
#ifdef HAVE_SECURITY_PAM_MODULES_H
|
|
#include <security/pam_modules.h>
|
|
#endif
|
|
|
|
#ifdef HAVE_SECURITY__PAM_MACROS_H
|
|
#include <security/_pam_macros.h>
|
|
#else
|
|
/* Define required macros from (Linux PAM 0.68) security/_pam_macros.h */
|
|
#define _pam_drop_reply(/* struct pam_response * */ reply, /* int */ replies) \
|
|
do { \
|
|
int reply_i; \
|
|
\
|
|
for (reply_i=0; reply_i<replies; ++reply_i) { \
|
|
if (reply[reply_i].resp) { \
|
|
_pam_overwrite(reply[reply_i].resp); \
|
|
free(reply[reply_i].resp); \
|
|
} \
|
|
} \
|
|
if (reply) \
|
|
free(reply); \
|
|
} while (0)
|
|
|
|
#define _pam_overwrite(x) \
|
|
do { \
|
|
register char *__xx__; \
|
|
if ((__xx__=(x))) \
|
|
while (*__xx__) \
|
|
*__xx__++ = '\0'; \
|
|
} while (0)
|
|
|
|
/*
|
|
* Don't just free it, forget it too.
|
|
*/
|
|
|
|
#define _pam_drop(X) SAFE_FREE(X)
|
|
|
|
#define x_strdup(s) ( (s) ? strdup(s):NULL )
|
|
#endif
|
|
|
|
#define WINBIND_DEBUG_ARG (1<<0)
|
|
#define WINBIND_USE_AUTHTOK_ARG (1<<1)
|
|
#define WINBIND_UNKNOWN_OK_ARG (1<<2)
|
|
#define WINBIND_TRY_FIRST_PASS_ARG (1<<3)
|
|
#define WINBIND_USE_FIRST_PASS_ARG (1<<4)
|
|
#define WINBIND__OLD_PASSWORD (1<<5)
|
|
|
|
/*
|
|
* here is the string to inform the user that the new passwords they
|
|
* typed were not the same.
|
|
*/
|
|
|
|
#define MISTYPED_PASS "Sorry, passwords do not match"
|
|
|
|
#define on(x, y) (x & y)
|
|
#define off(x, y) (!(x & y))
|
|
|
|
#include "winbind_nss_config.h"
|
|
#include "winbindd_nss.h"
|