nsswitch: Add try_authtok option to pam_winbind
authorMathieu Parent <math.parent@gmail.com>
Thu, 12 Apr 2018 09:57:15 +0000 (11:57 +0200)
committerAndreas Schneider <asn@cryptomilk.org>
Tue, 2 Oct 2018 12:12:13 +0000 (14:12 +0200)
Same as the use_authtok option, except that if the new password is not
valid, PAM will prompt for a password.

Bug-Debian: https://bugs.debian.org/858923
Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/570944

Signed-off-by: Mathieu Parent <math.parent@gmail.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
docs-xml/manpages/pam_winbind.8.xml
nsswitch/pam_winbind.c
nsswitch/pam_winbind.h

index f57a928..b8af5b5 100644 (file)
                </para></listitem>
                </varlistentry>
 
+               <varlistentry>
+               <term>try_authtok</term>
+               <listitem><para>
+               Same as the use_authtok option (previous item), except that if the new password is not
+               valid, PAM will prompt for a password.
+               </para></listitem>
+               </varlistentry>
+
                <varlistentry>
                <term>krb5_auth</term>
                <listitem><para>
index 7ac5bb0..1a58ba4 100644 (file)
@@ -492,6 +492,8 @@ config_from_pam:
                        ctrl |= WINBIND_SILENT;
                else if (!strcasecmp(*v, "use_authtok"))
                        ctrl |= WINBIND_USE_AUTHTOK_ARG;
+               else if (!strcasecmp(*v, "try_authtok"))
+                       ctrl |= WINBIND_TRY_AUTHTOK_ARG;
                else if (!strcasecmp(*v, "use_first_pass"))
                        ctrl |= WINBIND_USE_FIRST_PASS_ARG;
                else if (!strcasecmp(*v, "try_first_pass"))
@@ -3181,6 +3183,9 @@ int pam_sm_chauthtok(pam_handle_t * pamh, int flags,
                if (on(WINBIND_USE_AUTHTOK_ARG, lctrl)) {
                        lctrl |= WINBIND_USE_FIRST_PASS_ARG;
                }
+               if (on(WINBIND_TRY_AUTHTOK_ARG, lctrl)) {
+                       lctrl |= WINBIND_TRY_FIRST_PASS_ARG;
+               }
                retry = 0;
                ret = PAM_AUTHTOK_ERR;
                while ((ret != PAM_SUCCESS) && (retry++ < MAX_PASSWD_TRIES)) {
index d468efb..c6786d6 100644 (file)
@@ -156,6 +156,7 @@ do {                             \
 #define WINBIND_DEBUG_STATE            0x00001000
 #define WINBIND_WARN_PWD_EXPIRE                0x00002000
 #define WINBIND_MKHOMEDIR              0x00004000
+#define WINBIND_TRY_AUTHTOK_ARG                0x00008000
 
 #if defined(HAVE_GETTEXT) && !defined(__LCLINT__)
 #define _(string) dgettext(MODULE_NAME, string)