int
pam_get_user(pam_handle_t *pamh,
const char **user,
const char *prompt)
{
char prompt_buf[1024];
size_t prompt_size;
const void *promptp;
char *resp;
int r;
ENTER();
if (pamh == NULL || user == NULL)
RETURNC(PAM_SYSTEM_ERR);
r = pam_get_item(pamh, PAM_USER, (const void **)user);
if (r == PAM_SUCCESS && *user != NULL)
RETURNC(PAM_SUCCESS);
/* pam policy overrides the module's choice */
if ((promptp = openpam_get_option(pamh, "user_prompt")) != NULL)
prompt = promptp;
/* no prompt provided, see if there is one tucked away somewhere */
if (prompt == NULL)
if (pam_get_item(pamh, PAM_USER_PROMPT, &promptp) &&
promptp != NULL)
prompt = promptp;
/* fall back to hardcoded default */
if (prompt == NULL)
prompt = user_prompt;
/* expand */
prompt_size = sizeof prompt_buf;
r = openpam_subst(pamh, prompt_buf, &prompt_size, prompt);
if (r == PAM_SUCCESS && prompt_size <= sizeof prompt_buf)
prompt = prompt_buf;
r = pam_prompt(pamh, PAM_PROMPT_ECHO_ON, &resp, "%s", prompt);
if (r != PAM_SUCCESS)
RETURNC(r);
r = pam_set_item(pamh, PAM_USER, resp);
FREE(resp);
if (r != PAM_SUCCESS)
RETURNC(r);
r = pam_get_item(pamh, PAM_USER, (const void **)user);
RETURNC(r);
}
int
pam_get_authtok(pam_handle_t *pamh,
int item,
const char **authtok,
const char *prompt)
{
char prompt_buf[1024];
size_t prompt_size;
const void *oldauthtok, *prevauthtok, *promptp;
const char *prompt_option, *default_prompt;
const void *lhost, *rhost;
char *resp, *resp2;
int pitem, r, style, twice;
ENTER();
if (pamh == NULL || authtok == NULL)
RETURNC(PAM_SYSTEM_ERR);
*authtok = NULL;
twice = 0;
switch (item) {
case PAM_AUTHTOK:
pitem = PAM_AUTHTOK_PROMPT;
prompt_option = "authtok_prompt";
default_prompt = authtok_prompt;
r = pam_get_item(pamh, PAM_RHOST, &rhost);
if (r == PAM_SUCCESS && rhost != NULL) {
r = pam_get_item(pamh, PAM_HOST, &lhost);
if (r == PAM_SUCCESS && lhost != NULL) {
if (strcmp(rhost, lhost) != 0)
default_prompt = authtok_prompt_remote;
}
}
r = pam_get_item(pamh, PAM_OLDAUTHTOK, &oldauthtok);
if (r == PAM_SUCCESS && oldauthtok != NULL) {
default_prompt = newauthtok_prompt;
twice = 1;
}
break;
case PAM_OLDAUTHTOK:
pitem = PAM_OLDAUTHTOK_PROMPT;
prompt_option = "oldauthtok_prompt";
default_prompt = oldauthtok_prompt;
twice = 0;
break;
default:
RETURNC(PAM_SYMBOL_ERR);
}
if (openpam_get_option(pamh, "try_first_pass") ||
openpam_get_option(pamh, "use_first_pass")) {
r = pam_get_item(pamh, item, &prevauthtok);
if (r == PAM_SUCCESS && prevauthtok != NULL) {
*authtok = prevauthtok;
RETURNC(PAM_SUCCESS);
} else if (openpam_get_option(pamh, "use_first_pass")) {
RETURNC(r == PAM_SUCCESS ? PAM_AUTH_ERR : r);
}
}
/* pam policy overrides the module's choice */
if ((promptp = openpam_get_option(pamh, prompt_option)) != NULL)
prompt = promptp;
/* no prompt provided, see if there is one tucked away somewhere */
if (prompt == NULL)
if (pam_get_item(pamh, pitem, &promptp) && promptp != NULL)
prompt = promptp;
/* fall back to hardcoded default */
if (prompt == NULL)
prompt = default_prompt;
/* expand */
prompt_size = sizeof prompt_buf;
r = openpam_subst(pamh, prompt_buf, &prompt_size, prompt);
if (r == PAM_SUCCESS && prompt_size <= sizeof prompt_buf)
prompt = prompt_buf;
style = openpam_get_option(pamh, "echo_pass") ?
PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF;
r = pam_prompt(pamh, style, &resp, "%s", prompt);
if (r != PAM_SUCCESS)
RETURNC(r);
if (twice) {
r = pam_prompt(pamh, style, &resp2, "Retype %s", prompt);
if (r != PAM_SUCCESS) {
strlset(resp, 0, PAM_MAX_RESP_SIZE);
FREE(resp);
RETURNC(r);
}
if (strcmp(resp, resp2) != 0) {
strlset(resp, 0, PAM_MAX_RESP_SIZE);
FREE(resp);
}
strlset(resp2, 0, PAM_MAX_RESP_SIZE);
FREE(resp2);
}
if (resp == NULL)
RETURNC(PAM_TRY_AGAIN);
r = pam_set_item(pamh, item, resp);
strlset(resp, 0, PAM_MAX_RESP_SIZE);
FREE(resp);
if (r != PAM_SUCCESS)
RETURNC(r);
r = pam_get_item(pamh, item, (const void **)authtok);
RETURNC(r);
}
