144 lines
4.5 KiB
C
144 lines
4.5 KiB
C
/*-
|
|
* Copyright (c) 2002-2003 Networks Associates Technology, Inc.
|
|
* Copyright (c) 2004-2017 Dag-Erling Smørgrav
|
|
* All rights reserved.
|
|
*
|
|
* This software was developed for the FreeBSD Project by ThinkSec AS and
|
|
* Network Associates Laboratories, the Security Research Division of
|
|
* Network Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
|
|
* ("CBOSS"), as part of the DARPA CHATS research program.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
* 3. The name of the author may not be used to endorse or promote
|
|
* products derived from this software without specific prior written
|
|
* permission.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*/
|
|
|
|
#ifdef HAVE_CONFIG_H
|
|
# include "config.h"
|
|
#endif
|
|
|
|
#include <sys/param.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <security/pam_appl.h>
|
|
#include <security/openpam.h>
|
|
|
|
#include "openpam_impl.h"
|
|
|
|
static const char user_prompt[] = "Login:";
|
|
|
|
/*
|
|
* XSSO 4.2.1
|
|
* XSSO 6 page 52
|
|
*
|
|
* Retrieve user name
|
|
*/
|
|
|
|
int
|
|
pam_get_user(pam_handle_t *pamh,
|
|
const char **user,
|
|
const char *prompt)
|
|
{
|
|
char prompt_buf[1024];
|
|
size_t prompt_size;
|
|
const void *promptp;
|
|
char *resp;
|
|
int r;
|
|
|
|
ENTER();
|
|
r = pam_get_item(pamh, PAM_USER, (const void **)user);
|
|
if (r == PAM_SUCCESS && *user != NULL)
|
|
RETURNC(PAM_SUCCESS);
|
|
/* pam policy overrides the module's choice */
|
|
if ((promptp = openpam_get_option(pamh, "user_prompt")) != NULL)
|
|
prompt = promptp;
|
|
/* no prompt provided, see if there is one tucked away somewhere */
|
|
if (prompt == NULL) {
|
|
r = pam_get_item(pamh, PAM_USER_PROMPT, &promptp);
|
|
if (r == PAM_SUCCESS && promptp != NULL)
|
|
prompt = promptp;
|
|
}
|
|
/* fall back to hardcoded default */
|
|
if (prompt == NULL)
|
|
prompt = user_prompt;
|
|
/* expand */
|
|
prompt_size = sizeof prompt_buf;
|
|
r = openpam_subst(pamh, prompt_buf, &prompt_size, prompt);
|
|
if (r == PAM_SUCCESS && prompt_size <= sizeof prompt_buf)
|
|
prompt = prompt_buf;
|
|
r = pam_prompt(pamh, PAM_PROMPT_ECHO_ON, &resp, "%s", prompt);
|
|
if (r != PAM_SUCCESS)
|
|
RETURNC(r);
|
|
r = pam_set_item(pamh, PAM_USER, resp);
|
|
FREE(resp);
|
|
if (r != PAM_SUCCESS)
|
|
RETURNC(r);
|
|
r = pam_get_item(pamh, PAM_USER, (const void **)user);
|
|
RETURNC(r);
|
|
}
|
|
|
|
/*
|
|
* Error codes:
|
|
*
|
|
* =pam_get_item
|
|
* =pam_prompt
|
|
* =pam_set_item
|
|
* !PAM_SYMBOL_ERR
|
|
*/
|
|
|
|
/**
|
|
* The =pam_get_user function returns the name of the target user, as
|
|
* specified to =pam_start.
|
|
* If no user was specified, nor set using =pam_set_item, =pam_get_user
|
|
* will prompt for a user name.
|
|
* Either way, a pointer to the user name is stored in the location
|
|
* pointed to by the =user argument, and the corresponding PAM item is
|
|
* updated.
|
|
*
|
|
* The =prompt argument specifies a prompt to use if no user name is
|
|
* cached.
|
|
* If it is =NULL, the =PAM_USER_PROMPT item will be used.
|
|
* If that item is also =NULL, a hardcoded default prompt will be used.
|
|
* Additionally, when =pam_get_user is called from a service module, the
|
|
* prompt may be affected by module options as described below.
|
|
* The prompt is then expanded using =openpam_subst before it is passed to
|
|
* the conversation function.
|
|
*
|
|
* MODULE OPTIONS
|
|
*
|
|
* When called by a service module, =pam_get_user will recognize the
|
|
* following module options:
|
|
*
|
|
* ;user_prompt:
|
|
* Prompt to use when asking for the user name.
|
|
* This option overrides both the =prompt argument and the
|
|
* =PAM_USER_PROMPT item.
|
|
*
|
|
* >pam_conv
|
|
* >pam_get_item
|
|
* >pam_get_authtok
|
|
* >openpam_get_option
|
|
* >openpam_subst
|
|
*/
|