From 813bf8d63dd63ddbcaae7c0f63d0dc992048f5ba Mon Sep 17 00:00:00 2001 From: Bo Yang Date: Thu, 15 Oct 2009 06:23:48 +0800 Subject: [PATCH] s3: Don't fail authentication when one or some group of require-membership-of is invalid. Signed-off-by: Bo Yang (cherry picked from commit 31f1a36901b5b8959dc51401c09c114829b50392) --- nsswitch/pam_winbind.c | 25 +++++++++++++++++++++++-- 1 files changed, 23 insertions(+), 2 deletions(-) diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c index 132d637..ab22c7c 100644 --- a/nsswitch/pam_winbind.c +++ b/nsswitch/pam_winbind.c @@ -1053,7 +1053,23 @@ static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx, current_name, sid_list_buffer, sid_list_buffer_size)) { - goto out; + /* + * If one group name failed, we must not fail + * the authentication totally, continue with + * the following group names. If user belongs to + * one of the valid groups, we must allow it + * login. -- BoYang + */ + + _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, " + "check if group %s is valid group.", current_name, + current_name); + _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s " + "to sid, please contact your administrator to see " + "if group %s is valid."), current_name, current_name); + SAFE_FREE(current_name); + search_location = comma + 1; + continue; } SAFE_FREE(current_name); @@ -1069,7 +1085,12 @@ static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx, if (!winbind_name_to_sid_string(ctx, user, search_location, sid_list_buffer, sid_list_buffer_size)) { - goto out; + _pam_log(ctx, LOG_INFO, "cannot convert group %s to sid, " + "check if group %s is valid group.", search_location, + search_location); + _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s " + "to sid, please contact your administrator to see " + "if group %s is valid."), search_location, search_location); } result = true; -- 1.5.3