void ipa_access_handler(struct be_req *be_req)
{
struct pam_data *pd;
struct ipa_access_ctx *ipa_access_ctx;
struct tevent_req *req;
struct sss_domain_info *dom;
struct be_ctx *be_ctx = be_req_get_be_ctx(be_req);
pd = talloc_get_type(be_req_get_data(be_req), struct pam_data);
ipa_access_ctx = talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
struct ipa_access_ctx);
dom = be_ctx->domain;
if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
/* Subdomain request, verify subdomain */
dom = find_subdomain_by_name(be_ctx->domain, pd->domain, true);
}
/* First, verify that this account isn't locked.
* We need to do this in case the auth phase was
* skipped (such as during GSSAPI single-sign-on
* or SSH public key exchange.
*/
req = sdap_access_send(be_req, be_ctx->ev, be_ctx, dom,
ipa_access_ctx->sdap_access_ctx,
ipa_access_ctx->sdap_access_ctx->id_ctx->conn,
pd);
if (!req) {
be_req_terminate(be_req, DP_ERR_FATAL, PAM_SYSTEM_ERR, NULL);
return;
}
tevent_req_set_callback(req, ipa_hbac_check, be_req);
}
void sdap_pam_access_handler(struct be_req *breq)
{
struct be_ctx *be_ctx = be_req_get_be_ctx(breq);
struct pam_data *pd;
struct tevent_req *req;
struct sdap_access_ctx *access_ctx;
struct sss_domain_info *dom;
pd = talloc_get_type(be_req_get_data(breq), struct pam_data);
access_ctx =
talloc_get_type(be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
struct sdap_access_ctx);
dom = be_ctx->domain;
if (strcasecmp(pd->domain, be_ctx->domain->name) != 0) {
/* Subdomain request, verify subdomain */
dom = find_subdomain_by_name(be_ctx->domain, pd->domain, true);
}
req = sdap_access_send(breq, be_ctx->ev, be_ctx,
dom, access_ctx,
access_ctx->id_ctx->conn,
pd);
if (req == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE, ("Unable to start sdap_access request\n"));
sdap_access_reply(breq, PAM_SYSTEM_ERR);
return;
}
tevent_req_set_callback(req, sdap_access_done, breq);
}
void sdap_pam_access_handler(struct be_req *breq)
{
struct pam_data *pd;
struct tevent_req *req;
struct sdap_access_ctx *access_ctx;
pd = talloc_get_type(breq->req_data, struct pam_data);
access_ctx =
talloc_get_type(breq->be_ctx->bet_info[BET_ACCESS].pvt_bet_data,
struct sdap_access_ctx);
req = sdap_access_send(breq,
breq->be_ctx->ev,
breq,
access_ctx,
pd);
if (req == NULL) {
DEBUG(1, ("Unable to start sdap_access request\n"));
sdap_access_reply(breq, PAM_SYSTEM_ERR);
return;
}
tevent_req_set_callback(req, sdap_access_done, breq);
}