>From 0edcb7c575089e64f9b40ea46d0f5d3a54c8083d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20=C5=BDidek?= <mzidek@redhat.com>
Date: Wed, 10 Jun 2015 13:46:44 +0200
Subject: [PATCH] PAM: Add pam environment variable AUTH_DOMAIN to pam reply

Ticket:
https://fedorahosted.org/sssd/ticket/2476
---
 src/responder/pam/pamsrv.h      |  2 ++
 src/responder/pam/pamsrv_cmd.c  | 19 +++++++++++++++++++
 src/tests/cmocka/test_pam_srv.c | 29 +++++++++++++++++++++++++----
 3 files changed, 46 insertions(+), 4 deletions(-)

diff --git a/src/responder/pam/pamsrv.h b/src/responder/pam/pamsrv.h
index 066f35a..de2ff91 100644
--- a/src/responder/pam/pamsrv.h
+++ b/src/responder/pam/pamsrv.h
@@ -27,6 +27,8 @@
 #include "sbus/sssd_dbus.h"
 #include "responder/common/responder.h"
 
+#define PAM_ENV_AUTH_DOMAIN "AUTH_DOMAIN"
+
 struct pam_auth_req;
 
 typedef void (pam_dp_callback_t)(struct pam_auth_req *preq);
diff --git a/src/responder/pam/pamsrv_cmd.c b/src/responder/pam/pamsrv_cmd.c
index 1ca87a6..1392c55 100644
--- a/src/responder/pam/pamsrv_cmd.c
+++ b/src/responder/pam/pamsrv_cmd.c
@@ -579,9 +579,18 @@ static void pam_reply(struct pam_auth_req *preq)
     time_t delay_until = -1;
     char* pam_account_expired_message;
     int pam_verbosity;
+    char *env_buf;
+    TALLOC_CTX *tmp_ctx;
 
     pd = preq->pd;
     cctx = preq->cctx;
+
+    tmp_ctx = talloc_new(NULL);
+    if (tmp_ctx == NULL) {
+        ret = ENOMEM;
+        goto done;
+    }
+
     pctx = talloc_get_type(preq->cctx->rctx->pvt_ctx, struct pam_ctx);
 
     ret = confdb_get_int(pctx->rctx->cdb, CONFDB_PAM_CONF_ENTRY,
@@ -735,6 +744,15 @@ static void pam_reply(struct pam_auth_req *preq)
             DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed.\n");
             goto done;
         }
+
+        env_buf = talloc_asprintf(tmp_ctx, PAM_ENV_AUTH_DOMAIN"=%s",
+                                  pd->domain);
+        ret = pam_add_response(pd, SSS_PAM_ENV_ITEM,
+                               strlen(env_buf) + 1, (uint8_t*) env_buf);
+        if (ret != EOK) {
+            DEBUG(SSSDBG_CRIT_FAILURE, "pam_add_response failed.\n");
+            goto done;
+        }
     }
 
     resp_c = 0;
@@ -781,6 +799,7 @@ static void pam_reply(struct pam_auth_req *preq)
     }
 
 done:
+    talloc_free(tmp_ctx);
     sss_cmd_done(cctx, preq);
 }
 
diff --git a/src/tests/cmocka/test_pam_srv.c b/src/tests/cmocka/test_pam_srv.c
index 03faea2..2345346 100644
--- a/src/tests/cmocka/test_pam_srv.c
+++ b/src/tests/cmocka/test_pam_srv.c
@@ -298,17 +298,28 @@ static int test_pam_simple_check(uint32_t status, uint8_t *body, size_t blen)
     assert_int_equal(val, pam_test_ctx->exp_pam_status);
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
-    assert_int_equal(val, 1);
+    assert_int_equal(val, 2);
+
+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
+    assert_int_equal(val, SSS_PAM_ENV_ITEM);
+
+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
+    assert_int_equal(val, strlen(PAM_ENV_AUTH_DOMAIN"="TEST_DOM_NAME) + 1);
+
+    assert_int_equal(*(body + rp + val - 1), 0);
+    assert_string_equal(body + rp, PAM_ENV_AUTH_DOMAIN"="TEST_DOM_NAME);
+    rp += val;
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
     assert_int_equal(val, SSS_PAM_DOMAIN_NAME);
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
-    assert_int_equal(val, 9);
+    assert_int_equal(val, strlen(TEST_DOM_NAME) + 1);
 
     assert_int_equal(*(body + rp + val - 1), 0);
     assert_string_equal(body + rp, TEST_DOM_NAME);
 
+
     return EOK;
 }
 
@@ -326,13 +337,23 @@ static int test_pam_offline_chauthtok_check(uint32_t status,
     assert_int_equal(val, pam_test_ctx->exp_pam_status);
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
-    assert_int_equal(val, 2);
+    assert_int_equal(val, 3);
+
+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
+    assert_int_equal(val, SSS_PAM_ENV_ITEM);
+
+    SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
+    assert_int_equal(val, strlen(PAM_ENV_AUTH_DOMAIN"="TEST_DOM_NAME) + 1);
+
+    assert_int_equal(*(body + rp + val - 1), 0);
+    assert_string_equal(body + rp, PAM_ENV_AUTH_DOMAIN"="TEST_DOM_NAME);
+    rp += val;
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
     assert_int_equal(val, SSS_PAM_DOMAIN_NAME);
 
     SAFEALIGN_COPY_UINT32(&val, body + rp, &rp);
-    assert_int_equal(val, 9);
+    assert_int_equal(val, strlen(TEST_DOM_NAME) + 1);
 
     assert_int_equal(*(body + rp + val - 1), 0);
     assert_string_equal(body + rp, TEST_DOM_NAME);
-- 
2.1.0

