tobias/radicale
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #68 from shenek/master

Browse Source 
PAM fixes
This commit is contained in:
Guillaume Ayoub
2013-10-01 04:02:36 -07:00
parent 72d40d45e5 7c03089601
commit 7ce8caa913
1 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
radicale/auth/PAM.py
View File

@@ -36,6 +36,9 @@ GROUP_MEMBERSHIP = config.get("auth", "pam_group_membership")
def is_authenticated(user, password): def is_authenticated(user, password):
"""Check if ``user``/``password`` couple is valid.""" """Check if ``user``/``password`` couple is valid."""
if user is None or password is None:
return False
# Check whether the user exists in the PAM system # Check whether the user exists in the PAM system
try: try:
pwd.getpwnam(user).pw_uid pwd.getpwnam(user).pw_uid
@@ -47,6 +50,7 @@ def is_authenticated(user, password):
# Check whether the group exists # Check whether the group exists
try: try:
# Obtain supplementary groups
members = grp.getgrnam(GROUP_MEMBERSHIP).gr_mem members = grp.getgrnam(GROUP_MEMBERSHIP).gr_mem
except KeyError: except KeyError:
log.LOGGER.debug( log.LOGGER.debug(
@@ -54,18 +58,26 @@ def is_authenticated(user, password):
GROUP_MEMBERSHIP) GROUP_MEMBERSHIP)
return False return False
# Check whether the user belongs to the required group # Check whether the user exists
for member in members: try:
if member == user: # Get user primary group
log.LOGGER.debug( primary_group = grp.getgrgid(pwd.getpwnam(user).pw_gid).gr_name
"The PAM user belongs to the required group (%s)" % except KeyError:
GROUP_MEMBERSHIP) log.LOGGER.debug(
# Check the password "The PAM user (%s) doesn't exist" %
if pam.authenticate(user, password): user)
return True return False
else:
log.LOGGER.debug("Wrong PAM password") # Check whether the user belongs to the required group (primary or supplementary)
break if primary_group == GROUP_MEMBERSHIP or user in members:
log.LOGGER.debug(
"The PAM user belongs to the required group (%s)" %
GROUP_MEMBERSHIP)
# Check the password
if pam.authenticate(user, password):
return True
else:
log.LOGGER.debug("Wrong PAM password")
else: else:
log.LOGGER.debug( log.LOGGER.debug(
"The PAM user doesn't belong to the required group (%s)" % "The PAM user doesn't belong to the required group (%s)" %