pam-multi-cell-support-20020725

"will let you do
something like:

auth optional   /lib/security/pam_afs.so cell other-cell.domain.net
auth sufficient /lib/security/pam_afs.so try_first_pass refresh_token \
	cell main-cell.domain.net
auth required   /lib/security/pam_unix.so

You need to specify "refresh_token" the second time you call it to prevent
it from getting a second PAG and making your first token useless.

Or, you can just use it once to authenticate to a cell other than what's
in /usr/vice/etc/ThisCell.  Not specifying the "cell" argument causes the
expected behavior of authenticating against the local cell."

diff --git a/src/pam/afs_auth.c b/src/pam/afs_auth.c
index d1c7c14e16bc243b8fc4c4de4e25a83f07ffb70a..eb3dde929f3084bb878ab2eea52bfbb059645f10 100644 (file)
--- a/src/pam/afs_auth.c
+++ b/src/pam/afs_auth.c
@@ -47,6 +47,7 @@ pam_sm_authenticate(
     int ignore_uid  = 0;
     uid_t ignore_uid_id = 0;
     char my_password_buf[256];
+    char *cell_ptr=NULL;
     /*
      * these options are added to handle stupid apps, which won't call
      * pam_set_cred()
@@ -109,6 +110,14 @@ pam_sm_authenticate(
                        pam_afs_syslog(LOG_ERR, PAMAFS_IGNOREUID, argv[i]);
                 }
            }
+       } else if (strcasecmp(argv[i], "cell") == 0) {
+           i++;
+           if (i == argc) {
+                pam_afs_syslog(LOG_ERR, PAMAFS_OTHERCELL, "cell missing argument");
+           } else {
+               cell_ptr=argv[i];
+                pam_afs_syslog(LOG_INFO, PAMAFS_OTHERCELL, cell_ptr);
+           }       
        } else if (strcasecmp(argv[i], "refresh_token" ) == 0) {
            refresh_token = 1;
        } else if (strcasecmp(argv[i], "set_token" ) == 0) {
@@ -280,9 +289,9 @@ try_auth:
      */
        if (use_klog) { /* used by kdm 2.x */
           if (refresh_token || set_token) {
-             i = do_klog(user, password, NULL);
+             i = do_klog(user, password, NULL, cell_ptr);
           } else {
-             i = do_klog(user, password, "00:00:01");
+             i = do_klog(user, password, "00:00:01", cell_ptr);
              ktc_ForgetAllTokens();
            }
           if (logmask && LOG_MASK(LOG_DEBUG))
@@ -299,7 +308,7 @@ try_auth:
                  code = ka_UserAuthenticateGeneral(KA_USERAUTH_VERSION,
                                    user, /* kerberos name */
                                    (char *)0, /* instance */
-                                   (char *)0, /* realm */
+                                   cell_ptr, /* realm */
                                    password, /* password */
                                    0, /* default lifetime */
                                     &password_expires,
@@ -309,7 +318,7 @@ try_auth:
                  code = ka_VerifyUserPassword(KA_USERAUTH_VERSION,
                                    user, /* kerberos name */
                                    (char *)0, /* instance */
-                                   (char *)0, /* realm */
+                                   cell_ptr, /* realm */
                                    password, /* password */
                                    0, /* spare 2 */
                                    &reason /* error string */ );
@@ -350,7 +359,7 @@ try_auth:
             code = ka_UserAuthenticateGeneral(KA_USERAUTH_VERSION,
                                    user, /* kerberos name */
                                    (char *)0, /* instance */
-                                   (char *)0, /* realm */
+                                   cell_ptr, /* realm */
                                    password, /* password */
                                    0, /* default lifetime */
                                     &password_expires,
@@ -360,7 +369,7 @@ try_auth:
             code = ka_VerifyUserPassword(KA_USERAUTH_VERSION,
                                    user, /* kerberos name */
                                    (char *)0, /* instance */
-                                   (char *)0, /* realm */
+                                   cell_ptr, /* realm */
                                    password, /* password */
                                    0, /* spare 2 */
                                    &reason /* error string */ );

diff --git a/src/pam/afs_message.c b/src/pam/afs_message.c
index 7ba30225a8d05e661234422025c5f8416c04c7db..b2e083017cf0214c0d88d2aa110b51f0fc4313e4 100644 (file)
--- a/src/pam/afs_message.c
+++ b/src/pam/afs_message.c
@@ -85,6 +85,7 @@ static char *fallback_messages[] = {
     "ka error, code=%d",                        /* 44: KAERROR          */
     "Passwords are not equal",                  /* 45: NE_PASSWORD      */
     "AFS ignoring unregistered user %s\n"       /* 46: IGNORE_UNREG     */
+    "Alternate cell name: %s\n",               /* 47: OTHERCELL        */
 };
 
 static int num_fallbacks = sizeof(fallback_messages)/sizeof(char *);

diff --git a/src/pam/afs_message.h b/src/pam/afs_message.h
index 6ed88e1533ef1104600379453e17d0517233ae9c..27ee9b2db82c43f790ff21f3e72824de11664883 100644 (file)
--- a/src/pam/afs_message.h
+++ b/src/pam/afs_message.h
@@ -57,7 +57,7 @@
 #define PAMAFS_KAERROR          44 /* "ka error, code=%d"               */
 #define PAMAFS_NE_PASSWORD      45 /* "Passwords are not equal"         */
 #define PAMAFS_IGNORE_UNREG     46 /* "AFS ignoring unregistered user"  */
-
+#define PAMAFS_OTHERCELL       47 /* "Alternate cell name"             */
 
 char *pam_afs_message(int msgnum, int *freeit);
 void pam_afs_syslog(int priority, int msgid, ...);

diff --git a/src/pam/afs_setcred.c b/src/pam/afs_setcred.c
index 05e9eb8c907f5ba8d08526b1f36675d1860a5cc8..00de66ee0dcc992d3127484a50a4f24a7fb4e140 100644 (file)
--- a/src/pam/afs_setcred.c
+++ b/src/pam/afs_setcred.c
@@ -57,6 +57,7 @@ pam_sm_setcred(
     int i;
     struct pam_conv *pam_convp = NULL;
     char my_password_buf[256];
+    char *cell_ptr=NULL;
     char sbuffer[100];
     char *password = NULL;
     int torch_password = 1;
@@ -102,6 +103,14 @@ pam_sm_setcred(
                        pam_afs_syslog(LOG_ERR, PAMAFS_IGNOREUID, argv[i]);
                 }
            }
+        } else if (strcasecmp(argv[i], "cell") == 0) {
+            i++;
+            if (i == argc) {
+                pam_afs_syslog(LOG_ERR, PAMAFS_OTHERCELL, "cell missing argument");
+            } else {
+               cell_ptr = argv[i];
+                pam_afs_syslog(LOG_INFO, PAMAFS_OTHERCELL, cell_ptr);
+            }
        } else if (strcasecmp(argv[i], "no_unlog") == 0) {
            no_unlog = 1;
        } else if (strcasecmp(argv[i], "refresh_token" ) == 0) {
@@ -269,14 +278,14 @@ pam_sm_setcred(
 
        if ( flags & PAM_REFRESH_CRED ) {
            if (use_klog) {
-               auth_ok = ! do_klog(user, password, "00:00:01");
+               auth_ok = ! do_klog(user, password, "00:00:01", cell_ptr);
               ktc_ForgetAllTokens();
            } else {
             if ( ka_VerifyUserPassword(
                            KA_USERAUTH_VERSION,
                            user, /* kerberos name */
                            (char *)0, /* instance */
-                           (char *)0, /* realm */
+                           cell_ptr, /* realm */
                             password, /* password */
                             0, /* spare 2 */
                             &reason /* error string */
@@ -289,13 +298,13 @@ pam_sm_setcred(
        }
            
        if (  flags & PAM_ESTABLISH_CRED ) {
-          if (use_klog) auth_ok = ! do_klog(user, password, NULL);
+          if (use_klog) auth_ok = ! do_klog(user, password, NULL, cell_ptr);
           else {
            if ( ka_UserAuthenticateGeneral(
                            KA_USERAUTH_VERSION,
                            user, /* kerberos name */
                            (char *)0, /* instance */
-                           (char *)0, /* realm */
+                           cell_ptr, /* realm */
                             password, /* password */
                             0, /* default lifetime */
                             &password_expires,

diff --git a/src/pam/afs_util.c b/src/pam/afs_util.c
index ea1daad2138b9ed27f27dc5d3c55b6dfddcf7e1c..0f49d377eaec3337bbefb3806173815157229c90 100644 (file)
--- a/src/pam/afs_util.c
+++ b/src/pam/afs_util.c
@@ -91,7 +91,7 @@ char *cv2string(ttp, aval)
     return tp;
 }
 
-int do_klog(const char* user, const char* password, const char* lifetime)
+int do_klog(const char* user, const char* password, const char* lifetime, const char* cell_name)
 {
 pid_t  pid;
 int    pipedes[2];
@@ -117,6 +117,10 @@ int        ret = 1;
    argv[argc++] = "klog";
 #endif
    argv[argc++] = (char*)user;
+   if (cell_name) {
+      argv[argc++] = "-cell";
+      argv[argc++] = (char*)cell_name;
+   }
    argv[argc++] = "-silent";
    argv[argc++] = "-pipe";
    if (lifetime != NULL) {