More for sessions, working. TODO: configure list of sessions to record

diff --git a/contrib/slapd-modules/nssov/README b/contrib/slapd-modules/nssov/README
index 5ce2c86845f14121f907c00923f3d359cb7fab5c..4b728b3607eafc285a0627c999c5acf67a588d06 100644 (file)
--- a/contrib/slapd-modules/nssov/README
+++ b/contrib/slapd-modules/nssov/README
@@ -120,7 +120,7 @@ of the authorizedServiceObject auxiliary class) to use this method.
 Session management: the overlay may optionally add a "logged in" attribute
 to a user's entry for successful logins, and delete the corresponding
 value upon logout. The attribute value is of the form
-       <host> <service> <tty> <ruser@rhost> <generalizedTime>
+       <generalizedTime> <host> <service> <tty> (<ruser@rhost>)
 
 Password management: the overlay will perform a PasswordModify exop
 in the server for the given user.

diff --git a/contrib/slapd-modules/nssov/nss-ldapd/nss/pam.c b/contrib/slapd-modules/nssov/nss-ldapd/nss/pam.c
index 7a9d56e3b7c953e6503b7742cca347f41dfb141e..b6ad67fdfffd2e04a3501930ab4d7153a6206123 100644 (file)
--- a/contrib/slapd-modules/nssov/nss-ldapd/nss/pam.c
+++ b/contrib/slapd-modules/nssov/nss-ldapd/nss/pam.c
@@ -65,6 +65,7 @@ typedef struct pld_ctx {
        char *oldpw;
        int authok;
        int authz;
+       int sessid;
        char buf[1024];
 } pld_ctx;
 
@@ -414,6 +415,14 @@ int pam_sm_acct_mgmt(
        return rc;
 }
 
+static enum nss_status pam_read_sess(
+       TFILE *fp,pld_ctx *ctx,int *errnop)
+{
+       int tmpint32;
+       READ_INT32(fp,ctx->sessid);
+       return NSS_STATUS_SUCCESS;
+}
+
 static enum nss_status pam_do_sess(
        pam_handle_t *pamh,pld_ctx *ctx,int action,int *errnop)
 {
@@ -431,12 +440,13 @@ static enum nss_status pam_do_sess(
                WRITE_STRING(fp,svc);
                WRITE_STRING(fp,tty);
                WRITE_STRING(fp,rhost);
-               WRITE_STRING(fp,ruser),
-               NSS_STATUS_SUCCESS);
+               WRITE_STRING(fp,ruser);
+               WRITE_INT32(fp,ctx->sessid),
+               pam_read_sess(fp,ctx,errnop));
        }
 }
 
-int pam_sm_session(
+static int pam_sm_session(
        pam_handle_t *pamh, int flags, int argc, const char **argv,
        int action, int *no_warn)
 {

diff --git a/contrib/slapd-modules/nssov/nssov.c b/contrib/slapd-modules/nssov/nssov.c
index 619d040b334ec73ea37ac12f77999c01f5a2e71b..5a5878ad968b5fdba6d25438278cc080dc809eea 100644 (file)
--- a/contrib/slapd-modules/nssov/nssov.c
+++ b/contrib/slapd-modules/nssov/nssov.c
@@ -688,7 +688,10 @@ nssov_db_init(
        slap_overinst *on = (slap_overinst *)be->bd_info;
        nssov_info *ni;
        nssov_mapinfo *mi;
-       int i, j;
+       int rc;
+
+       rc = nssov_pam_init();
+       if (rc) return rc;
 
        ni = ch_malloc( sizeof(nssov_info) );
        on->on_bi.bi_private = ni;

diff --git a/contrib/slapd-modules/nssov/nssov.h b/contrib/slapd-modules/nssov/nssov.h
index 9c822d5e3c53780bec1e7caa59dbc6b3cca57718..54f8fa91d3a84622e15b2a6d13f81feffeabad9b 100644 (file)
--- a/contrib/slapd-modules/nssov/nssov.h
+++ b/contrib/slapd-modules/nssov/nssov.h
@@ -187,6 +187,8 @@ void nssov_rpc_init(nssov_info *ni);
 void nssov_service_init(nssov_info *ni);
 void nssov_shadow_init(nssov_info *ni);
 
+int nssov_pam_init(void);
+
 /* these are the different functions that handle the database
    specific actions, see nslcd.h for the action descriptions */
 int nssov_alias_byname(nssov_info *ni,TFILE *fp,Operation *op);

diff --git a/contrib/slapd-modules/nssov/pam.c b/contrib/slapd-modules/nssov/pam.c
index 0e2f3ffd0d4df619471d11d2b0e32b151fa8686c..b43c25915be50d1b2c7dec1955dd7db7d2d506d4 100644 (file)
--- a/contrib/slapd-modules/nssov/pam.c
+++ b/contrib/slapd-modules/nssov/pam.c
@@ -14,10 +14,22 @@
  */
 
 #include "nssov.h"
+#include "lutil.h"
 
 #include <security/pam_modules.h>
 
 static int ppolicy_cid;
+static AttributeDescription *ad_loginStatus;
+
+const char *at_loginStatus =
+       "( 1.3.6.1.4.1.4745.1.20.1 "
+       "NAME ( 'loginStatus' ) "
+       "DESC 'Currently logged in sessions for a user' "
+       "EQUALITY caseIgnoreMatch "
+       "SUBSTR caseIgnoreSubstringsMatch "
+       "ORDERING caseIgnoreOrderingMatch "
+       "SYNTAX OMsDirectoryString "
+       "USAGE directoryOperation )";
 
 struct paminfo {
        struct berval uid;
@@ -234,11 +246,6 @@ finish:
        return 0;
 }
 
-static int pam_nullcb(Operation *op, SlapReply *rs)
-{
-       return LDAP_SUCCESS;
-}
-
 static struct berval grpmsg =
        BER_BVC("Access denied by group check");
 static struct berval hostmsg =
@@ -330,7 +337,7 @@ int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
                        }
                }
 
-               cb.sc_response = pam_nullcb;
+               cb.sc_response = slap_null_cb;
                cb.sc_private = NULL;
                op->o_tag = LDAP_REQ_COMPARE;
                op->o_req_dn = hostdn;
@@ -354,7 +361,7 @@ int pam_authz(nssov_info *ni,TFILE *fp,Operation *op)
                ni->ni_pam_group_ad) {
                AttributeAssertion ava = ATTRIBUTEASSERTION_INIT;
                op->o_callback = &cb;
-               cb.sc_response = pam_nullcb;
+               cb.sc_response = slap_null_cb;
                op->o_tag = LDAP_REQ_COMPARE;
                op->o_req_dn = ni->ni_pam_group_dn;
                op->o_req_ndn = ni->ni_pam_group_dn;
@@ -449,7 +456,7 @@ finish:
        return 0;
 }
 
-int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
+static int pam_sess(nssov_info *ni,TFILE *fp,Operation *op,int action)
 {
        struct berval dn, uid, svc, tty, rhost, ruser;
        int32_t tmpint32;
@@ -459,6 +466,12 @@ int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
        char ttyc[32];
        char rhostc[256];
        char ruserc[32];
+       slap_callback cb = {0};
+       SlapReply rs = {REP_RESULT};
+       char timebuf[LDAP_LUTIL_GENTIME_BUFSIZE];
+       struct berval timestamp, bv[2], *nbv;
+       time_t stamp;
+       Modifications mod;
 
        READ_STRING_BUF2(fp,uidc,sizeof(uidc));
        uid.bv_val = uidc;
@@ -478,51 +491,65 @@ int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
        READ_STRING_BUF2(fp,ruserc,sizeof(ruserc));
        ruser.bv_val = ruserc;
        ruser.bv_len = tmpint32;
+       READ_INT32(fp,stamp);
 
-       Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_o(%s)\n",dn.bv_val,0,0);
+       Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_%c(%s)\n",
+               action==NSLCD_ACTION_PAM_SESS_O ? 'o' : 'c', dn.bv_val,0);
+
+       if (!dn.bv_len) return 0;
+
+       slap_op_time( &op->o_time, &op->o_tincr );
+       timestamp.bv_len = sizeof(timebuf);
+       timestamp.bv_val = timebuf;
+       if (action == NSLCD_ACTION_PAM_SESS_O )
+               stamp = op->o_time;
+       slap_timestamp( &stamp, &timestamp );
+       bv[0].bv_len = timestamp.bv_len + global_host_bv.bv_len + svc.bv_len +
+               tty.bv_len + ruser.bv_len + rhost.bv_len + STRLENOF("    (@)");
+       bv[0].bv_val = op->o_tmpalloc( bv[0].bv_len+1, op->o_tmpmemctx );
+       sprintf(bv[0].bv_val, "%s %s %s %s (%s@%s)",
+               timestamp.bv_val, global_host_bv.bv_val, svc.bv_val, tty.bv_val,
+               ruser.bv_val, rhost.bv_val);
+       
+       mod.sml_numvals = 1;
+       mod.sml_values = bv;
+       BER_BVZERO(&bv[1]);
+       attr_normalize( ad_loginStatus, bv, &nbv, op->o_tmpmemctx );
+       mod.sml_nvalues = nbv;
+       mod.sml_desc = ad_loginStatus;
+       mod.sml_op = action == NSLCD_ACTION_PAM_SESS_O ? LDAP_MOD_ADD :
+               LDAP_MOD_DELETE;
+       mod.sml_flags = SLAP_MOD_INTERNAL;
+       mod.sml_next = NULL;
+
+       cb.sc_response = slap_null_cb;
+       op->o_callback = &cb;
+       op->o_tag = LDAP_REQ_MODIFY;
+       op->orm_modlist = &mod;
+       op->orm_no_opattrs = 1;
+       op->o_req_dn = dn;
+       op->o_req_ndn = dn;
+       op->o_bd->be_modify( op, &rs );
+       if ( mod.sml_next ) {
+               slap_mods_free( mod.sml_next, 1 );
+       }
+       ber_bvarray_free_x( nbv, op->o_tmpmemctx );
 
        WRITE_INT32(fp,NSLCD_VERSION);
-       WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_O);
+       WRITE_INT32(fp,action);
        WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
+       WRITE_INT32(fp,op->o_time);
        return 0;
 }
 
-int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
+int pam_sess_o(nssov_info *ni,TFILE *fp,Operation *op)
 {
-       struct berval dn, uid, svc, tty, rhost, ruser;
-       int32_t tmpint32;
-       char dnc[1024];
-       char svcc[256];
-       char uidc[32];
-       char ttyc[32];
-       char rhostc[256];
-       char ruserc[32];
-
-       READ_STRING_BUF2(fp,uidc,sizeof(uidc));
-       uid.bv_val = uidc;
-       uid.bv_len = tmpint32;
-       READ_STRING_BUF2(fp,dnc,sizeof(dnc));
-       dn.bv_val = dnc;
-       dn.bv_len = tmpint32;
-       READ_STRING_BUF2(fp,svcc,sizeof(svcc));
-       svc.bv_val = svcc;
-       svc.bv_len = tmpint32;
-       READ_STRING_BUF2(fp,ttyc,sizeof(ttyc));
-       tty.bv_val = ttyc;
-       tty.bv_len = tmpint32;
-       READ_STRING_BUF2(fp,rhostc,sizeof(rhostc));
-       rhost.bv_val = rhostc;
-       rhost.bv_len = tmpint32;
-       READ_STRING_BUF2(fp,ruserc,sizeof(ruserc));
-       ruser.bv_val = ruserc;
-       ruser.bv_len = tmpint32;
-
-       Debug(LDAP_DEBUG_TRACE,"nssov_pam_sess_c(%s)\n",dn.bv_val,0,0);
+       return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_O);
+}
 
-       WRITE_INT32(fp,NSLCD_VERSION);
-       WRITE_INT32(fp,NSLCD_ACTION_PAM_SESS_C);
-       WRITE_INT32(fp,NSLCD_RESULT_SUCCESS);
-       return 0;
+int pam_sess_c(nssov_info *ni,TFILE *fp,Operation *op)
+{
+       return pam_sess(ni,fp,op,NSLCD_ACTION_PAM_SESS_C);
 }
 
 int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
@@ -587,7 +614,7 @@ int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
                op->o_ndn = pi.dn;
                op->o_callback = &cb;
                op->o_conn->c_authz_backend = op->o_bd;
-               cb.sc_response = pam_nullcb;
+               cb.sc_response = slap_null_cb;
                op->o_bd = frontendDB;
                rc = op->o_bd->be_extended(op, &rs);
                if (rs.sr_text)
@@ -606,3 +633,11 @@ int pam_pwmod(nssov_info *ni,TFILE *fp,Operation *op)
        WRITE_BERVAL(fp,&pi.msg);
        return 0;
 }
+
+int nssov_pam_init()
+{
+       int code = 0;
+       if (!ad_loginStatus)
+               code = register_at( at_loginStatus, &ad_loginStatus, 0 );
+       return code;
+}