* [devel] Q: pam(auth) и set_pam_item() - нет пути
@ 2009-08-04 17:02 Alexey I. Froloff
0 siblings, 0 replies; only message in thread
From: Alexey I. Froloff @ 2009-08-04 17:02 UTC (permalink / raw)
To: ALT Devel discussion list
[-- Attachment #1: Type: text/plain, Size: 1340 bytes --]
Есть модуль (pam_pkcs11), которому необязательно знать имя
пользователя. Он маппит сертификат с токена в логин (например
через GECOS). Вот код:
483 if ( is_spaced_str(user) ) {
484 /*
485 if provided user is null or empty extract and set user
486 name from certificate
487 */
488 DBG("Empty login: try to deduce from certificate");
489 user=find_user(x509);
490 if (!user) {
...
495 } else {
496 DBG1("certificate is valid and matches user %s",user);
497 /* try to set up PAM user entry with evaluated value */
498 rv = pam_set_item(pamh, PAM_USER,(const void *)user);
...
505 chosen_cert = cert_list[i];
506 break; /* end loop, as find user success */
507 }
508 } else {
Код выполняется, pam_set_item() успешно отрабатывает, этот модуль
возвращает PAM_SUCCESS, только ни login, ни gdm пользователя не
пускают. pam_authenticate() отвечает login'у что "User not known
to underlying authentication module". system-auth выглядит так:
auth [success=1 default=ignore] pam_pkcs11.so
auth required pam_tcb.so shadow fork prefix=$2a$ count=8 nullok
auth required pam_permit.so
Тем не менее хотелось бы невозбранно достигнуть желаемого?
--
Regards,
Sir Raorn.
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 197 bytes --]
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2009-08-04 17:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-08-04 17:02 [devel] Q: pam(auth) и set_pam_item() - нет пути Alexey I. Froloff
ALT Linux Team development discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/devel/0 devel/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 devel devel/ http://lore.altlinux.org/devel \
devel@altlinux.org devel@altlinux.ru devel@lists.altlinux.org devel@lists.altlinux.ru devel@linux.iplabs.ru mandrake-russian@linuxteam.iplabs.ru sisyphus@linuxteam.iplabs.ru
public-inbox-index devel
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.devel
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git