35 #include "shared/safealign.h" 47 #define SSS_NSS_PROTOCOL_VERSION 1 48 #define SSS_PAM_PROTOCOL_VERSION 3 49 #define SSS_SUDO_PROTOCOL_VERSION 1 50 #define SSS_AUTOFS_PROTOCOL_VERSION 1 51 #define SSS_SSH_PROTOCOL_VERSION 0 52 #define SSS_PAC_PROTOCOL_VERSION 1 55 #define SSS_NAME_MAX LOGIN_NAME_MAX 57 #define SSS_NAME_MAX 256 69 SSS_CLI_NULL = 0x0000,
72 SSS_GET_VERSION = 0x0001,
76 SSS_NSS_GETPWNAM = 0x0011,
77 SSS_NSS_GETPWUID = 0x0012,
78 SSS_NSS_SETPWENT = 0x0013,
79 SSS_NSS_GETPWENT = 0x0014,
80 SSS_NSS_ENDPWENT = 0x0015,
82 SSS_NSS_GETPWNAM_EX = 0x0019,
83 SSS_NSS_GETPWUID_EX = 0x001A,
87 SSS_NSS_GETGRNAM = 0x0021,
88 SSS_NSS_GETGRGID = 0x0022,
89 SSS_NSS_SETGRENT = 0x0023,
90 SSS_NSS_GETGRENT = 0x0024,
91 SSS_NSS_ENDGRENT = 0x0025,
92 SSS_NSS_INITGR = 0x0026,
94 SSS_NSS_GETGRNAM_EX = 0x0029,
95 SSS_NSS_GETGRGID_EX = 0x002A,
96 SSS_NSS_INITGR_EX = 0x002E,
101 SSS_NSS_GETALIASBYNAME = 0x0031,
102 SSS_NSS_GETALIASBYPORT = 0x0032,
103 SSS_NSS_SETALIASENT = 0x0033,
104 SSS_NSS_GETALIASENT = 0x0034,
105 SSS_NSS_ENDALIASENT = 0x0035,
109 SSS_NSS_GETHOSTTON = 0x0041,
110 SSS_NSS_GETNTOHOST = 0x0042,
111 SSS_NSS_SETETHERENT = 0x0043,
112 SSS_NSS_GETETHERENT = 0x0044,
113 SSS_NSS_ENDETHERENT = 0x0045,
117 SSS_NSS_GETHOSTBYNAME = 0x0051,
118 SSS_NSS_GETHOSTBYNAME2 = 0x0052,
119 SSS_NSS_GETHOSTBYADDR = 0x0053,
120 SSS_NSS_SETHOSTENT = 0x0054,
121 SSS_NSS_GETHOSTENT = 0x0055,
122 SSS_NSS_ENDHOSTENT = 0x0056,
126 SSS_NSS_SETNETGRENT = 0x0061,
127 SSS_NSS_GETNETGRENT = 0x0062,
128 SSS_NSS_ENDNETGRENT = 0x0063,
133 SSS_NSS_GETNETBYNAME = 0x0071,
134 SSS_NSS_GETNETBYADDR = 0x0072,
135 SSS_NSS_SETNETENT = 0x0073,
136 SSS_NSS_GETNETENT = 0x0074,
137 SSS_NSS_ENDNETENT = 0x0075,
141 SSS_NSS_GETPROTOBYNAME = 0x0081,
142 SSS_NSS_GETPROTOBYNUM = 0x0082,
143 SSS_NSS_SETPROTOENT = 0x0083,
144 SSS_NSS_GETPROTOENT = 0x0084,
145 SSS_NSS_ENDPROTOENT = 0x0085,
149 SSS_NSS_GETRPCBYNAME = 0x0091,
150 SSS_NSS_GETRPCBYNUM = 0x0092,
151 SSS_NSS_SETRPCENT = 0x0093,
152 SSS_NSS_GETRPCENT = 0x0094,
153 SSS_NSS_ENDRPCENT = 0x0095,
158 SSS_NSS_GETSERVBYNAME = 0x00A1,
159 SSS_NSS_GETSERVBYPORT = 0x00A2,
160 SSS_NSS_SETSERVENT = 0x00A3,
161 SSS_NSS_GETSERVENT = 0x00A4,
162 SSS_NSS_ENDSERVENT = 0x00A5,
167 SSS_NSS_GETSPNAM = 0x00B1,
168 SSS_NSS_GETSPUID = 0x00B2,
169 SSS_NSS_SETSPENT = 0x00B3,
170 SSS_NSS_GETSPENT = 0x00B4,
171 SSS_NSS_ENDSPENT = 0x00B5,
175 SSS_SUDO_GET_SUDORULES = 0x00C1,
176 SSS_SUDO_GET_DEFAULTS = 0x00C2,
179 SSS_AUTOFS_SETAUTOMNTENT = 0x00D1,
180 SSS_AUTOFS_GETAUTOMNTENT = 0x00D2,
181 SSS_AUTOFS_GETAUTOMNTBYNAME = 0x00D3,
182 SSS_AUTOFS_ENDAUTOMNTENT = 0x00D4,
185 SSS_SSH_GET_USER_PUBKEYS = 0x00E1,
186 SSS_SSH_GET_HOST_PUBKEYS = 0x00E2,
236 SSS_PAC_ADD_PAC_USER = 0x0101,
352 #define SSS_START_OF_PAM_REQUEST 0x4d415049 353 #define SSS_END_OF_PAM_REQUEST 0x4950414d 355 #define PAM_PREAUTH_INDICATOR PUBCONF_PATH"/pam_preauth_available" 358 SSS_PAM_ITEM_EMPTY = 0x0000,
360 SSS_PAM_ITEM_SERVICE,
364 SSS_PAM_ITEM_AUTHTOK,
365 SSS_PAM_ITEM_NEWAUTHTOK,
366 SSS_PAM_ITEM_CLI_LOCALE,
367 SSS_PAM_ITEM_CLI_PID,
368 SSS_PAM_ITEM_REQUESTED_DOMAINS,
372 #define PAM_CLI_FLAGS_USE_FIRST_PASS (1 << 0) 373 #define PAM_CLI_FLAGS_FORWARD_PASS (1 << 1) 374 #define PAM_CLI_FLAGS_USE_AUTHTOK (1 << 2) 375 #define PAM_CLI_FLAGS_IGNORE_UNKNOWN_USER (1 << 3) 376 #define PAM_CLI_FLAGS_IGNORE_AUTHINFO_UNAVAIL (1 << 4) 377 #define PAM_CLI_FLAGS_USE_2FA (1 << 5) 378 #define PAM_CLI_FLAGS_ALLOW_MISSING_NAME (1 << 6) 379 #define PAM_CLI_FLAGS_PROMPT_ALWAYS (1 << 7) 380 #define PAM_CLI_FLAGS_TRY_CERT_AUTH (1 << 8) 381 #define PAM_CLI_FLAGS_REQUIRE_CERT_AUTH (1 << 9) 383 #define SSS_NSS_MAX_ENTRIES 256 384 #define SSS_NSS_HEADER_SIZE (sizeof(uint32_t) * 4) 385 struct sss_cli_req_data {
391 #define SSS_CLI_SOCKET_TIMEOUT 300000 583 enum prompt_config_type {
592 struct prompt_config;
594 enum prompt_config_type pc_get_type(
struct prompt_config *pc);
595 const char *pc_get_password_prompt(
struct prompt_config *pc);
596 const char *pc_get_2fa_1st_prompt(
struct prompt_config *pc);
597 const char *pc_get_2fa_2nd_prompt(
struct prompt_config *pc);
598 const char *pc_get_2fa_single_prompt(
struct prompt_config *pc);
599 void pc_list_free(
struct prompt_config **pc_list);
600 errno_t pc_list_add_password(
struct prompt_config ***pc_list,
602 errno_t pc_list_add_2fa(
struct prompt_config ***pc_list,
603 const char *prompt_1st,
const char *prompt_2nd);
604 errno_t pc_list_add_2fa_single(
struct prompt_config ***pc_list,
606 errno_t pam_get_response_prompt_config(
struct prompt_config **pc_list,
int *len,
608 errno_t pc_list_from_response(
int size, uint8_t *buf,
609 struct prompt_config ***pc_list);
611 enum sss_netgr_rep_type {
612 SSS_NETGR_REP_TRIPLE = 1,
616 enum sss_cli_error_codes {
617 ESSS_SSS_CLI_ERROR_START = 0x1000,
618 ESSS_BAD_PRIV_SOCKET,
621 ESSS_SERVER_NOT_TRUSTED,
623 ESSS_SOCKET_STAT_ERROR,
625 ESS_SSS_CLI_ERROR_MAX
628 const char *ssscli_err2string(
int err);
631 struct sss_cli_req_data *rd,
632 uint8_t **repbuf,
size_t *replen,
636 struct sss_cli_req_data *rd,
638 uint8_t **repbuf,
size_t *replen,
642 struct sss_cli_req_data *rd,
643 uint8_t **repbuf,
size_t *replen,
645 void sss_pam_close_fd(
void);
651 int sss_pac_check_and_open(
void);
654 struct sss_cli_req_data *rd,
655 uint8_t **repbuf,
size_t *replen,
659 struct sss_cli_req_data *rd,
660 uint8_t **repbuf,
size_t *replen,
664 struct sss_cli_req_data *rd,
665 uint8_t **repbuf,
size_t *replen,
669 struct sss_cli_req_data *rd,
670 uint8_t **repbuf,
size_t *replen,
674 struct sss_cli_req_data *rd,
675 uint8_t **repbuf,
size_t *replen,
704 errno_t sss_strnlen(
const char *str,
size_t maxlen,
size_t *len);
706 void sss_nss_lock(
void);
707 void sss_nss_unlock(
void);
708 void sss_pam_lock(
void);
709 void sss_pam_unlock(
void);
710 void sss_nss_mc_lock(
void);
711 void sss_nss_mc_unlock(
void);
712 void sss_pac_lock(
void);
713 void sss_pac_unlock(
void);
715 errno_t sss_readrep_copy_string(
const char *in,
Authentication token is a path to a Kerberos credential cache file, it may or may no contain a traili...
Definition: sss_cli.h:329
sss_cli_command
The allowed commands an SSS client can send to the SSSD.
Definition: sss_cli.h:67
Tell the user how low a new authentication is delayed.
Definition: sss_cli.h:527
Takes an unsigned 32bit integer (POSIX ID) and returns the zero terminated string representation of t...
Definition: sss_cli.h:243
Warn the user that the password is expired and inform about the remaining number of grace logins...
Definition: sss_cli.h:551
A message indicating that Smartcard/certificate based authentication is available and contains detail...
Definition: sss_cli.h:460
Indicates that on the server side Smartcard/certificate based authentication is available for the sel...
Definition: sss_cli.h:475
Message for the system log.
Definition: sss_cli.h:430
see pam_sm_close_session(3) for details
Definition: sss_cli.h:216
Same as SSS_PAM_CERT_INFO but user name might be missing and should be prompted for.
Definition: sss_cli.h:481
Takes the zero terminated string of the base64 encoded DER representation of a X509 certificate and r...
Definition: sss_cli.h:270
Takes an unsigned 32bit integer (POSIX UID) and reurn the zero terminated string representation of th...
Definition: sss_cli.h:275
Takes a zero terminated fully qualified name and returns the zero terminated string representation of...
Definition: sss_cli.h:239
A message which optionally may contain the name of the vendor, the ID of an OTP token and a challenge...
Definition: sss_cli.h:454
see pam_sm_setcred(3) for details
Definition: sss_cli.h:210
Inform the user that the authentication happened offline.
Definition: sss_cli.h:516
Authentication token is a Smart Card PIN, it may or may no contain a trailing \0. ...
Definition: sss_cli.h:336
Tell the user that the account has expired and optionally give a reason.
Definition: sss_cli.h:561
No authentication token available.
Definition: sss_cli.h:324
Takes a zero terminated fully qualified name and returns a list of zero terminated strings with key-v...
Definition: sss_cli.h:258
Authentication token indicates Smart Card authentication is used and that the PIN will be entered at ...
Definition: sss_cli.h:339
response_type
Types of different messages.
Definition: sss_cli.h:429
see pam_sm_open_session(3) for details
Definition: sss_cli.h:214
Tell the user that a password change failed and optionally give a reason.
Definition: sss_cli.h:543
sss_authtok_type
The different types of authentication tokens.
Definition: sss_cli.h:323
Set and environment variable with pam_putenv(3).
Definition: sss_cli.h:436
Definition: sss_cli.h:536
A message which should be displayed to the user.
Definition: sss_cli.h:447
Warn the user that the password will expire soon.
Definition: sss_cli.h:556
Takes an unsigned 32bit integer (POSIX GID) and reurn the zero terminated string representation of th...
Definition: sss_cli.h:279
Indicates that the authtok was a OTP, so don't cache it.
Definition: sss_cli.h:467
Request which can be run before an authentication request to find out which authentication methods ar...
Definition: sss_cli.h:230
Set and environment variable with putenv(3).
Definition: sss_cli.h:439
Indicates that password prompting is possible.
Definition: sss_cli.h:470
Takes the zero terminated string representation of a SID and returns the zero terminated fully qualif...
Definition: sss_cli.h:247
Takes the zero terminated string representation of a SID and returns and returns the POSIX ID of the ...
Definition: sss_cli.h:251
see pam_sm_acct_mgmt(3) for details
Definition: sss_cli.h:212
Name of the domain the user belongs too.
Definition: sss_cli.h:432
Takes the zero terminated string of the base64 encoded DER representation of a X509 certificate and r...
Definition: sss_cli.h:265
Contains data which controls which credentials are expected and how the user is prompted for them...
Definition: sss_cli.h:484
user_info_type
Different types of user messages.
Definition: sss_cli.h:515
Authentication token is a password, it may or may no contain a trailing \0.
Definition: sss_cli.h:326
see pam_sm_authenticate(3) for details.
Definition: sss_cli.h:189
Set and environment variable with putenv(3) and pam_putenv(3).
Definition: sss_cli.h:442
second run of the password change operation where the PAM_UPDATE_AUTHTOK flag is set and the real cha...
Definition: sss_cli.h:218
first run of the password change operation where the PAM_PRELIM_CHECK flag is set, see pam_sm_chauthtok(3) for details
Definition: sss_cli.h:223
Authentication token has two factors, they may or may no contain a trailing \0.
Definition: sss_cli.h:333
Tell the user that he needs to kinit or login and logout to get a TGT after an OTP password change...
Definition: sss_cli.h:540
A plain text message which should be displayed to the user.
Definition: sss_cli.h:450
Authentication token has two factors in a single string, it may or may no contain a trailing \0...
Definition: sss_cli.h:343
Renew a credential with a limited lifetime, e.g.
Definition: sss_cli.h:227