2 * Unix SMB/CIFS implementation.
3 * PAM error mapping functions
4 * Copyright (C) Andrew Bartlett 2002
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #ifdef WITH_HAVE_SECURITY_PAM_APPL_H
23 #include <security/pam_appl.h>
25 #if defined(PAM_AUTHTOK_RECOVERY_ERR) && !defined(PAM_AUTHTOK_RECOVER_ERR)
26 #define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_RECOVERY_ERR
29 /* PAM -> NT_STATUS map */
33 } pam_to_nt_status_map
[] = {
34 {PAM_OPEN_ERR
, NT_STATUS_UNSUCCESSFUL
},
35 {PAM_SYMBOL_ERR
, NT_STATUS_UNSUCCESSFUL
},
36 {PAM_SERVICE_ERR
, NT_STATUS_UNSUCCESSFUL
},
37 {PAM_SYSTEM_ERR
, NT_STATUS_UNSUCCESSFUL
},
38 {PAM_BUF_ERR
, NT_STATUS_UNSUCCESSFUL
},
39 {PAM_PERM_DENIED
, NT_STATUS_ACCESS_DENIED
},
40 {PAM_AUTH_ERR
, NT_STATUS_WRONG_PASSWORD
},
41 {PAM_CRED_INSUFFICIENT
, NT_STATUS_INSUFFICIENT_LOGON_INFO
}, /* FIXME: Is this correct? */
42 {PAM_AUTHINFO_UNAVAIL
, NT_STATUS_LOGON_FAILURE
},
43 {PAM_USER_UNKNOWN
, NT_STATUS_NO_SUCH_USER
},
44 {PAM_MAXTRIES
, NT_STATUS_REMOTE_SESSION_LIMIT
}, /* FIXME: Is this correct? */
45 {PAM_NEW_AUTHTOK_REQD
, NT_STATUS_PASSWORD_MUST_CHANGE
},
46 {PAM_ACCT_EXPIRED
, NT_STATUS_ACCOUNT_EXPIRED
},
47 {PAM_SESSION_ERR
, NT_STATUS_INSUFFICIENT_RESOURCES
},
48 {PAM_CRED_UNAVAIL
, NT_STATUS_NO_TOKEN
}, /* FIXME: Is this correct? */
49 {PAM_CRED_EXPIRED
, NT_STATUS_PASSWORD_EXPIRED
}, /* FIXME: Is this correct? */
50 {PAM_CRED_ERR
, NT_STATUS_UNSUCCESSFUL
},
51 {PAM_AUTHTOK_ERR
, NT_STATUS_UNSUCCESSFUL
},
52 #ifdef PAM_AUTHTOK_RECOVER_ERR
53 {PAM_AUTHTOK_RECOVER_ERR
, NT_STATUS_UNSUCCESSFUL
},
55 {PAM_AUTHTOK_EXPIRED
, NT_STATUS_PASSWORD_EXPIRED
},
56 {PAM_SUCCESS
, NT_STATUS_OK
}
59 /* NT_STATUS -> PAM map */
63 } nt_status_to_pam_map
[] = {
64 {NT_STATUS_UNSUCCESSFUL
, PAM_SYSTEM_ERR
},
65 {NT_STATUS_NO_SUCH_USER
, PAM_USER_UNKNOWN
},
66 {NT_STATUS_WRONG_PASSWORD
, PAM_AUTH_ERR
},
67 {NT_STATUS_LOGON_FAILURE
, PAM_AUTH_ERR
},
68 {NT_STATUS_ACCOUNT_EXPIRED
, PAM_ACCT_EXPIRED
},
69 {NT_STATUS_PASSWORD_EXPIRED
, PAM_AUTHTOK_EXPIRED
},
70 {NT_STATUS_PASSWORD_MUST_CHANGE
, PAM_NEW_AUTHTOK_REQD
},
71 {NT_STATUS_OK
, PAM_SUCCESS
}
74 /*****************************************************************************
75 convert a PAM error to a NT status32 code
76 *****************************************************************************/
77 NTSTATUS
pam_to_nt_status(int pam_error
)
80 if (pam_error
== 0) return NT_STATUS_OK
;
82 for (i
=0; NT_STATUS_V(pam_to_nt_status_map
[i
].ntstatus
); i
++) {
83 if (pam_error
== pam_to_nt_status_map
[i
].pam_code
)
84 return pam_to_nt_status_map
[i
].ntstatus
;
86 return NT_STATUS_UNSUCCESSFUL
;
89 /*****************************************************************************
90 convert an NT status32 code to a PAM error
91 *****************************************************************************/
92 int nt_status_to_pam(NTSTATUS nt_status
)
95 if NT_STATUS_IS_OK(nt_status
) return PAM_SUCCESS
;
97 for (i
=0; NT_STATUS_V(nt_status_to_pam_map
[i
].ntstatus
); i
++) {
98 if (NT_STATUS_EQUAL(nt_status
,nt_status_to_pam_map
[i
].ntstatus
))
99 return nt_status_to_pam_map
[i
].pam_code
;
101 return PAM_SYSTEM_ERR
;
106 /*****************************************************************************
107 convert a PAM error to a NT status32 code
108 *****************************************************************************/
109 NTSTATUS
pam_to_nt_status(int pam_error
)
111 if (pam_error
== 0) return NT_STATUS_OK
;
112 return NT_STATUS_UNSUCCESSFUL
;
115 /*****************************************************************************
116 convert an NT status32 code to a PAM error
117 *****************************************************************************/
118 int nt_status_to_pam(NTSTATUS nt_status
)
120 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_OK
)) return 0;
121 return 4; /* PAM_SYSTEM_ERR */