oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Fix k5login_authoritative

Browse Source 
In the previous implementation when .k5login or .k5login.d existed
and k5login_authoritative was false, no further plugins were tried.
Also when k5login_authoritative was true and .k5login did not match,
the directory was never tried.
This commit is contained in:
Viktor Dukhovni
2014-01-08 23:41:55 +00:00
committed by Viktor Dukhovni
parent 788d39b3ce
commit bb895bdd90
1 changed files with 21 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
lib/krb5/kuserok.c
View File

@@ -650,30 +650,40 @@ kuserok_user_k5login_plug_f(void *plug_ctx, krb5_context context,
path[strlen(path) - strlen(".d")] = '\0'; path[strlen(path) - strlen(".d")] = '\0';
ret = check_one_file(context, path, luser, FALSE, principal, result); ret = check_one_file(context, path, luser, FALSE, principal, result);
if (ret == 0 && /*
((flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) || *result == TRUE)) { * A match in ~/.k5login is sufficient. A non-match, falls through to the
* .k5login.d code below.
*/
if (ret == 0 && *result == TRUE) {
free(path); free(path);
return 0; return 0;
} }
if (ret != ENOENT) if (ret != ENOENT)
found_file = TRUE; found_file = TRUE;
path[strlen(path)] = '.'; /* put back the .d; clever|hackish? you decide */ /*
* A match in ~/.k5login.d/somefile is sufficient. A non-match, falls
* through to the code below that handles negative results.
*
* XXX: put back the .d; clever|hackish? you decide
*/
path[strlen(path)] = '.';
ret = check_directory(context, path, luser, FALSE, principal, result); ret = check_directory(context, path, luser, FALSE, principal, result);
free(path); free(path);
if (ret == 0 && if (ret == 0 && *result == TRUE)
((flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE) || *result == TRUE))
return 0; return 0;
if (ret != ENOENT && ret != ENOTDIR) if (ret != ENOENT && ret != ENOTDIR)
found_file = TRUE; found_file = TRUE;
/*
* When either ~/.k5login or ~/.k5login.d/ exists, but neither matches
* and we're authoritative, we're done. Otherwise, give other plugins
* a chance.
*/
*result = FALSE; *result = FALSE;
if (found_file == FALSE) if (found_file && (flags & KUSEROK_K5LOGIN_IS_AUTHORITATIVE))
return KRB5_PLUGIN_NO_HANDLE; return 0;
return KRB5_PLUGIN_NO_HANDLE;
return 0;
#endif #endif
} }