Changeset 100 in openpam

Timestamp:

Apr 6, 2002, 5:05:21 PM (19 years ago)

Author:

Dag-Erling Smørgrav

Message:

Change pam_get_authtok()'s prototype so the caller can specify
what token it wants. Also introduce PAM_OLDAUTHTOK_PROMPT.

Sponsored by: DARPA, NAI Labs

Location:

trunk

Files:

• include/security/openpam.h (modified) (2 diffs)
• include/security/pam_constants.h (modified) (2 diffs)
• lib/pam_get_authtok.c (modified) (5 diffs)
• lib/pam_get_item.c (modified) (3 diffs)
• lib/pam_set_item.c (modified) (2 diffs)

trunk/include/security/openpam.h

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/include/security/openpam.h#12 $
+ * $P4: //depot/projects/openpam/include/security/openpam.h#13 $
  */
 
@@ -66 +66 @@
 int
 pam_get_authtok(pam_handle_t *_pamh,
+        int _item,
         const char **_authtok,
         const char *_prompt);

trunk/include/security/pam_constants.h

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/include/security/pam_constants.h#12 $
+ * $P4: //depot/projects/openpam/include/security/pam_constants.h#13 $
  */
 
@@ -120 +120 @@
         PAM_USER_PROMPT                 =   9,
         PAM_AUTHTOK_PROMPT              =  10,          /* OpenPAM extension */
+        PAM_OLDAUTHTOK_PROMPT           =  11,          /* OpenPAM extension */
         PAM_NUM_ITEMS                                   /* OpenPAM extension */
 };

trunk/lib/pam_get_authtok.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_get_authtok.c#12 $
+ * $P4: //depot/projects/openpam/lib/pam_get_authtok.c#13 $
  */
 
@@ -42 +42 @@
 #include "openpam_impl.h"
 
+const char authtok_prompt[] = "Password:";
+const char oldauthtok_prompt[] = "Old Password:";
+
 /*
  * OpenPAM extension
@@ -50 +53 @@
 int
 pam_get_authtok(pam_handle_t *pamh,
+        int item,
         const char **authtok,
         const char *prompt)
 {
-        char *p, *resp;
-        int r, style;
+        const char *default_prompt;
+        char *resp;
+        int pitem, r, style;
 
         if (pamh == NULL || authtok == NULL)
                 return (PAM_SYSTEM_ERR);
 
+        *authtok = NULL;
+        switch (item) {
+        case PAM_AUTHTOK:
+                pitem = PAM_AUTHTOK_PROMPT;
+                default_prompt = authtok_prompt;
+                break;
+        case PAM_OLDAUTHTOK:
+                pitem = PAM_OLDAUTHTOK_PROMPT;
+                default_prompt = oldauthtok_prompt;
+                break;
+        default:
+                return (PAM_SYMBOL_ERR);
+        }
+
         if (openpam_get_option(pamh, "try_first_pass") ||
             openpam_get_option(pamh, "use_first_pass")) {
-                r = pam_get_item(pamh, PAM_AUTHTOK, (const void **)authtok);
+                r = pam_get_item(pamh, item, (const void **)authtok);
                 if (r == PAM_SUCCESS && *authtok != NULL)
                         return (PAM_SUCCESS);
@@ -67 +86 @@
                         return (r == PAM_SUCCESS ? PAM_AUTH_ERR : r);
         }
-        if (pam_get_item(pamh, PAM_AUTHTOK_PROMPT,
-            (const void **)&p) != PAM_SUCCESS || p == NULL)
-                if (prompt == NULL)
-                        prompt = "Password:";
+        if (prompt == NULL) {
+                r = pam_get_item(pamh, pitem, (const void **)&prompt);
+                if (r != PAM_SUCCESS || prompt == NULL)
+                        prompt = default_prompt;
+        }
         style = openpam_get_option(pamh, "echo_pass") ?
             PAM_PROMPT_ECHO_ON : PAM_PROMPT_ECHO_OFF;
-        r = pam_prompt(pamh, style, &resp, "%s", p ? p : prompt);
+        r = pam_prompt(pamh, style, &resp, "%s", prompt);
         if (r != PAM_SUCCESS)
                 return (r);
         *authtok = resp;
-        return (pam_set_item(pamh, PAM_AUTHTOK, *authtok));
+        return (pam_set_item(pamh, item, *authtok));
 }
 
@@ -88 +108 @@
  *      !PAM_SYMBOL_ERR
  */
+
+/**
+ * The =pam_get_authtok function returns the cached authentication token,
+ * or prompts the user if no token is currently cached.  Either way, a
+ * pointer to the authentication token is stored in the location pointed
+ * to by the =authtok argument.
+ *
+ * The =item argument must have one of the following values:
+ *
+ *      =PAM_AUTHTOK
+ *              Returns the current authentication token, or the new token
+ *              when changing authentication tokens.
+ *      =PAM_OLDAUTHTOK
+ *              Returns the previous authentication token when changing
+ *              authentication tokens.
+ *
+ * The =prompt argument specifies a prompt to use if no token is cached.
+ * If =NULL, the =PAM_AUTHTOK_PROMPT or =PAM_OLDAUTHTOK_PROMPT item, as
+ * appropriate, will be used.  If that item is also =NULL, a hardcoded
+ * default prompt will be used.
+ *
+ * >pam_get_item
+ */

trunk/lib/pam_get_item.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_get_item.c#10 $
+ * $P4: //depot/projects/openpam/lib/pam_get_item.c#11 $
  */
 
@@ -67 +67 @@
         case PAM_USER_PROMPT:
         case PAM_AUTHTOK_PROMPT:
+        case PAM_OLDAUTHTOK_PROMPT:
                 *item = pamh->item[item_type];
                 return (PAM_SUCCESS);
@@ -113 +114 @@
  *              The prompt to use when asking the applicant for an
  *              authentication token.
+ *      =PAM_OLDAUTHTOK_PROMPT:
+ *              The prompt to use when asking the applicant for an
+ *              expired authentication token prior to changing it.
  *
  * See =pam_start for a description of =struct pam_conv.

trunk/lib/pam_set_item.c

@@ -32 +32 @@
  * SUCH DAMAGE.
  *
- * $P4: //depot/projects/openpam/lib/pam_set_item.c#12 $
+ * $P4: //depot/projects/openpam/lib/pam_set_item.c#13 $
  */
 
@@ -74 +74 @@
         case PAM_USER_PROMPT:
         case PAM_AUTHTOK_PROMPT:
+        case PAM_OLDAUTHTOK_PROMPT:
                 if (*slot != NULL)
                         size = strlen(*slot) + 1;