|
Tomas Mraz |
446e70 |
# HG changeset patch
|
|
Tomas Mraz |
446e70 |
# User Tomas Mraz <tmraz@redhat.com>
|
|
Tomas Mraz |
446e70 |
# Date 1427477516 -3600
|
|
Tomas Mraz |
446e70 |
# Fri Mar 27 18:31:56 2015 +0100
|
|
Tomas Mraz |
446e70 |
# Node ID 8c4cdeb97a91c7b959234eccc6ad216691529c3d
|
|
Tomas Mraz |
446e70 |
# Parent 93a10a7118a58f3fe0d8d8f7c4e81fed57f29c15
|
|
Tomas Mraz |
446e70 |
Support pam_sss.so prompting for password for non-local users.
|
|
Tomas Mraz |
446e70 |
|
|
Tomas Mraz |
446e70 |
See bug 1195817
|
|
Tomas Mraz |
446e70 |
|
|
Tomas Mraz |
446e70 |
diff -r 93a10a7118a5 -r 8c4cdeb97a91 authinfo.py
|
|
Tomas Mraz |
446e70 |
--- a/authinfo.py Fri Mar 27 16:16:53 2015 +0100
|
|
Tomas Mraz |
446e70 |
+++ b/authinfo.py Fri Mar 27 18:31:56 2015 +0100
|
|
Tomas Mraz |
446e70 |
@@ -136,6 +136,7 @@
|
|
Tomas Mraz |
446e70 |
LOGIC_SKIPNEXT = "[success=1 default=ignore]"
|
|
Tomas Mraz |
446e70 |
LOGIC_SKIPNEXT3 = "[success=3 default=ignore]"
|
|
Tomas Mraz |
446e70 |
LOGIC_ALWAYS_SKIP = "[default=1]"
|
|
Tomas Mraz |
446e70 |
+LOGIC_SKIPNEXT_ON_FAILURE = "[default=1 success=ok]"
|
|
Tomas Mraz |
446e70 |
|
|
Tomas Mraz |
446e70 |
# Snip off line terminators and final whitespace from a passed-in string.
|
|
Tomas Mraz |
446e70 |
def snipString(s):
|
|
Tomas Mraz |
446e70 |
@@ -464,6 +465,8 @@
|
|
Tomas Mraz |
446e70 |
"permit", []],
|
|
Tomas Mraz |
446e70 |
[False, AUTH, LOGIC_SUFFICIENT,
|
|
Tomas Mraz |
446e70 |
"fprintd", []],
|
|
Tomas Mraz |
446e70 |
+ [False, AUTH, LOGIC_SKIPNEXT_ON_FAILURE,
|
|
Tomas Mraz |
446e70 |
+ "localuser", []],
|
|
Tomas Mraz |
446e70 |
[True, AUTH, LOGIC_SUFFICIENT,
|
|
Tomas Mraz |
446e70 |
"unix", argv_unix_auth],
|
|
Tomas Mraz |
446e70 |
[False, AUTH, LOGIC_REQUISITE,
|
|
Tomas Mraz |
446e70 |
@@ -587,6 +590,8 @@
|
|
Tomas Mraz |
446e70 |
"env", []],
|
|
Tomas Mraz |
446e70 |
[False, AUTH, LOGIC_REQUIRED,
|
|
Tomas Mraz |
446e70 |
"deny", []],
|
|
Tomas Mraz |
446e70 |
+ [False, AUTH, LOGIC_SKIPNEXT_ON_FAILURE,
|
|
Tomas Mraz |
446e70 |
+ "localuser", []],
|
|
Tomas Mraz |
446e70 |
[True, AUTH, LOGIC_SUFFICIENT,
|
|
Tomas Mraz |
446e70 |
"unix", argv_unix_auth],
|
|
Tomas Mraz |
446e70 |
[False, AUTH, LOGIC_REQUISITE,
|
|
Tomas Mraz |
446e70 |
@@ -3814,6 +3819,10 @@
|
|
Tomas Mraz |
446e70 |
argv = module[ARGV][0:] # shallow copy
|
|
Tomas Mraz |
446e70 |
argv[1] = self.uidMin
|
|
Tomas Mraz |
446e70 |
args = " ".join(argv)
|
|
Tomas Mraz |
446e70 |
+ # do not continue to following modules if authentication fails
|
|
Tomas Mraz |
446e70 |
+ if name == "unix" and stack == "auth" and (self.enableSSSDAuth or
|
|
Tomas Mraz |
446e70 |
+ self.implicitSSSDAuth or self.enableIPAv2) and (not self.enableNIS):
|
|
Tomas Mraz |
446e70 |
+ logic = LOGIC_FORCE_PKCS11 # make it or break it logic
|
|
Tomas Mraz |
446e70 |
# use oddjob_mkhomedir if available
|
|
Tomas Mraz |
446e70 |
if name == "mkhomedir" and os.access("%s/pam_%s.so"
|
|
Tomas Mraz |
446e70 |
% (AUTH_MODULE_DIR, "oddjob_mkhomedir"), os.X_OK):
|
|
Tomas Mraz |
446e70 |
@@ -3841,6 +3850,8 @@
|
|
Tomas Mraz |
446e70 |
args = self.mkhomedirArgs
|
|
Tomas Mraz |
446e70 |
if name == "systemd":
|
|
Tomas Mraz |
446e70 |
args = self.systemdArgs
|
|
Tomas Mraz |
446e70 |
+ if name == "sss" and stack == "auth" and not self.enableNIS:
|
|
Tomas Mraz |
446e70 |
+ args = "forward_pass"
|
|
Tomas Mraz |
446e70 |
if not args and module[ARGV]:
|
|
Tomas Mraz |
446e70 |
args = " ".join(module[ARGV])
|
|
Tomas Mraz |
446e70 |
if name == "winbind" and self.winbindOffline and stack != "password":
|
|
Tomas Mraz |
446e70 |
@@ -3945,7 +3956,9 @@
|
|
Tomas Mraz |
446e70 |
(self.enablePasswdQC and module[NAME] == "passwdqc") or
|
|
Tomas Mraz |
446e70 |
(self.enableWinbindAuth and module[NAME] == "winbind") or
|
|
Tomas Mraz |
446e70 |
((self.enableSSSDAuth or self.implicitSSSDAuth or self.enableIPAv2) and module[NAME] == "sss") or
|
|
Tomas Mraz |
446e70 |
- (self.enableLocAuthorize and module[NAME] == "localuser") or
|
|
Tomas Mraz |
446e70 |
+ ((self.enableSSSDAuth or self.implicitSSSDAuth or self.enableIPAv2) and
|
|
Tomas Mraz |
446e70 |
+ (not self.enableNIS) and module[NAME] == "localuser" and module[STACK] == AUTH) or
|
|
Tomas Mraz |
446e70 |
+ (self.enableLocAuthorize and module[NAME] == "localuser" and module[STACK] == ACCOUNT) or
|
|
Tomas Mraz |
446e70 |
(self.enablePAMAccess and module[NAME] == "access") or
|
|
Tomas Mraz |
446e70 |
(self.enableMkHomeDir and module[NAME] == "mkhomedir") or
|
|
Tomas Mraz |
446e70 |
(not self.enableSysNetAuth and module[STACK] == AUTH and
|