dovecot - Jun 2007 - User mapping via pam

Hi,

 

I'm trying to change the PAM_USER within a pam module, and observed that
dovecot 0.99 does not support this. I then looked at 1.x and found:

 

 src/auth/passdb-pam.c:232:

 

        /* FIXME: this doesn't actually work since we're in the child

           process.. */

        status = pam_get_item(pamh, PAM_USER, (linux_const void
**)&item);

        if (status != PAM_SUCCESS) {

                *error = t_strdup_printf("pam_get_item() failed: %s",

                                         pam_strerror(pamh, status));

                return status;

        }

        auth_request_set_field(request, "user", item, NULL);

 

however it appeared to me that the auth process was passing this
username to the parent in its response.

 

Is this issue resolved? I compiled and tested mapping the username sso
to the user andrew:

 

Jun 27 13:38:45 itsrv dovecot: auth-worker(default): pam(sso,10.x.x.x):
lookup service=imap

Jun 27 13:38:45 itsrv dovecot: auth(default): auth(sso,10.x.x.x):
username changed sso -> andrew

Jun 27 13:38:45 itsrv dovecot: auth(default): client out: OK    1
user=andrew

Jun 27 13:50:57 itsrv dovecot: auth(default): master in: REQUEST
1       19761   1

Jun 27 13:50:57 itsrv dovecot: auth(default): passwd(andrew,10.x.x.x):
lookup

Jun 27 13:50:57 itsrv dovecot: auth(default): master out: USER  1
andrew  system_user=andrew      uid=1001        gid=1001
home=/home/Andrew

 

Also, is this behavior dependant on me setting blocking=yes for "passdb
pam" in dovecot.conf? (for this test It was set)

 

Thanks,

Andrew Flannery

On Wed, 2007-06-27 at 13:53 -0400, Flannery, Andrew
wrote:
> I'm trying to change the PAM_USER within a pam module, and observed
that
> dovecot 0.99 does not support this. I then looked at 1.x and found:
..
>         /* FIXME: this doesn't actually work since we're in the
child
> 
>            process.. */
..
> however it appeared to me that the auth process was passing this
> username to the parent in its response.
..
> Also, is this behavior dependant on me setting blocking=yes for
> "passdb
> pam" in dovecot.conf? (for this test It was set)
Yes. It works only with blocking=yes. I hadn't thought about that
before. Updated http://wiki.dovecot.org/PasswordDatabase/PAM
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20070627/e294dc92/attachment-0002.bin>