sssd 2.9.4
sss_cli.h
1/*
2 SSSD
3
4 Client Interface for NSS and PAM.
5
6 Authors:
7 Simo Sorce <ssorce@redhat.com>
8
9 Copyright (C) Red Hat, Inc 2007
10
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU Lesser General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
15
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU Lesser General Public License for more details.
20
21 You should have received a copy of the GNU Lesser General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
23*/
24
25#ifndef _SSSCLI_H
26#define _SSSCLI_H
27
28#include <nss.h>
29#include <pwd.h>
30#include <grp.h>
31#include <string.h>
32#include <stdint.h>
33#include <limits.h>
34
35#include "shared/safealign.h"
36
37#ifndef HAVE_ERRNO_T
38#define HAVE_ERRNO_T
39typedef int errno_t;
40#endif
41
42
43#ifndef EOK
44#define EOK 0
45#endif
46
47#define SSS_NSS_PROTOCOL_VERSION 1
48#define SSS_PAM_PROTOCOL_VERSION 3
49#define SSS_SUDO_PROTOCOL_VERSION 1
50#define SSS_AUTOFS_PROTOCOL_VERSION 1
51#define SSS_SSH_PROTOCOL_VERSION 0
52#define SSS_PAC_PROTOCOL_VERSION 1
53
54#ifdef LOGIN_NAME_MAX
55#define SSS_NAME_MAX LOGIN_NAME_MAX
56#else
57#define SSS_NAME_MAX 256
58#endif
59
68/* null */
69 SSS_CLI_NULL = 0x0000,
70
71/* version */
72 SSS_GET_VERSION = 0x0001,
73
74/* passwd */
75
76 SSS_NSS_GETPWNAM = 0x0011,
77 SSS_NSS_GETPWUID = 0x0012,
78 SSS_NSS_SETPWENT = 0x0013,
79 SSS_NSS_GETPWENT = 0x0014,
80 SSS_NSS_ENDPWENT = 0x0015,
81
82 SSS_NSS_GETPWNAM_EX = 0x0019,
83 SSS_NSS_GETPWUID_EX = 0x001A,
84
85/* group */
86
87 SSS_NSS_GETGRNAM = 0x0021,
88 SSS_NSS_GETGRGID = 0x0022,
89 SSS_NSS_SETGRENT = 0x0023,
90 SSS_NSS_GETGRENT = 0x0024,
91 SSS_NSS_ENDGRENT = 0x0025,
92 SSS_NSS_INITGR = 0x0026,
93
94 SSS_NSS_GETGRNAM_EX = 0x0029,
95 SSS_NSS_GETGRGID_EX = 0x002A,
96 SSS_NSS_INITGR_EX = 0x002E,
97
98#if 0
99/* aliases */
100
101 SSS_NSS_GETALIASBYNAME = 0x0031,
102 SSS_NSS_GETALIASBYPORT = 0x0032,
103 SSS_NSS_SETALIASENT = 0x0033,
104 SSS_NSS_GETALIASENT = 0x0034,
105 SSS_NSS_ENDALIASENT = 0x0035,
106
107/* ethers */
108
109 SSS_NSS_GETHOSTTON = 0x0041,
110 SSS_NSS_GETNTOHOST = 0x0042,
111 SSS_NSS_SETETHERENT = 0x0043,
112 SSS_NSS_GETETHERENT = 0x0044,
113 SSS_NSS_ENDETHERENT = 0x0045,
114#endif
115
116/* hosts */
117
118 SSS_NSS_GETHOSTBYNAME = 0x0051,
119 SSS_NSS_GETHOSTBYNAME2 = 0x0052,
120 SSS_NSS_GETHOSTBYADDR = 0x0053,
121 SSS_NSS_SETHOSTENT = 0x0054,
122 SSS_NSS_GETHOSTENT = 0x0055,
123 SSS_NSS_ENDHOSTENT = 0x0056,
124
125/* netgroup */
126
127 SSS_NSS_SETNETGRENT = 0x0061,
128 SSS_NSS_GETNETGRENT = 0x0062,
129 SSS_NSS_ENDNETGRENT = 0x0063,
130
131/* networks */
132
133 SSS_NSS_GETNETBYNAME = 0x0071,
134 SSS_NSS_GETNETBYADDR = 0x0072,
135 SSS_NSS_SETNETENT = 0x0073,
136 SSS_NSS_GETNETENT = 0x0074,
137 SSS_NSS_ENDNETENT = 0x0075,
138
139#if 0
140/* protocols */
141
142 SSS_NSS_GETPROTOBYNAME = 0x0081,
143 SSS_NSS_GETPROTOBYNUM = 0x0082,
144 SSS_NSS_SETPROTOENT = 0x0083,
145 SSS_NSS_GETPROTOENT = 0x0084,
146 SSS_NSS_ENDPROTOENT = 0x0085,
147
148/* rpc */
149
150 SSS_NSS_GETRPCBYNAME = 0x0091,
151 SSS_NSS_GETRPCBYNUM = 0x0092,
152 SSS_NSS_SETRPCENT = 0x0093,
153 SSS_NSS_GETRPCENT = 0x0094,
154 SSS_NSS_ENDRPCENT = 0x0095,
155#endif
156
157/* services */
158
159 SSS_NSS_GETSERVBYNAME = 0x00A1,
160 SSS_NSS_GETSERVBYPORT = 0x00A2,
161 SSS_NSS_SETSERVENT = 0x00A3,
162 SSS_NSS_GETSERVENT = 0x00A4,
163 SSS_NSS_ENDSERVENT = 0x00A5,
164
165#if 0
166/* shadow */
167
168 SSS_NSS_GETSPNAM = 0x00B1,
169 SSS_NSS_GETSPUID = 0x00B2,
170 SSS_NSS_SETSPENT = 0x00B3,
171 SSS_NSS_GETSPENT = 0x00B4,
172 SSS_NSS_ENDSPENT = 0x00B5,
173#endif
174
175/* SUDO */
176 SSS_SUDO_GET_SUDORULES = 0x00C1,
177 SSS_SUDO_GET_DEFAULTS = 0x00C2,
178
179/* autofs */
180 SSS_AUTOFS_SETAUTOMNTENT = 0x00D1,
181 SSS_AUTOFS_GETAUTOMNTENT = 0x00D2,
182 SSS_AUTOFS_GETAUTOMNTBYNAME = 0x00D3,
183 SSS_AUTOFS_ENDAUTOMNTENT = 0x00D4,
184
185/* SSH */
186 SSS_SSH_GET_USER_PUBKEYS = 0x00E1,
187 SSS_SSH_GET_HOST_PUBKEYS = 0x00E2,
188
189/* PAM related calls */
190 SSS_PAM_AUTHENTICATE = 0x00F1,
211 SSS_PAM_SETCRED = 0x00F2,
213 SSS_PAM_ACCT_MGMT = 0x00F3,
215 SSS_PAM_OPEN_SESSION = 0x00F4,
217 SSS_PAM_CLOSE_SESSION = 0x00F5,
219 SSS_PAM_CHAUTHTOK = 0x00F6,
224 SSS_PAM_CHAUTHTOK_PRELIM = 0x00F7,
228 SSS_CMD_RENEW = 0x00F8,
231 SSS_PAM_PREAUTH = 0x00F9,
238/* PAC responder calls */
239 SSS_PAC_ADD_PAC_USER = 0x0101,
240
241/* ID-SID mapping calls */
242SSS_NSS_GETSIDBYNAME = 0x0111,
246SSS_NSS_GETSIDBYID = 0x0112,
250SSS_NSS_GETNAMEBYSID = 0x0113,
254SSS_NSS_GETIDBYSID = 0x0114,
261SSS_NSS_GETORIGBYNAME = 0x0115,
268SSS_NSS_GETNAMEBYCERT = 0x0116,
273SSS_NSS_GETLISTBYCERT = 0x0117,
278SSS_NSS_GETSIDBYUID = 0x0118,
282SSS_NSS_GETSIDBYGID = 0x0119,
310/* subid */
311 SSS_NSS_GET_SUBID_RANGES = 0x0130,
313};
314 /* end of group sss_cli_command */
318
319 /* end of group sss_pam */
340
354 SSS_AUTHTOK_TYPE_EMPTY = 0x0000,
359 SSS_AUTHTOK_TYPE_CCFILE = 0x0002,
363 SSS_AUTHTOK_TYPE_2FA = 0x0003,
366 SSS_AUTHTOK_TYPE_SC_PIN = 0x0004,
376 SSS_AUTHTOK_TYPE_OAUTH2 = 0x0007,
381 SSS_AUTHTOK_TYPE_PASSKEY = 0x0008,
390};
391 /* end of group sss_authtok_type */
395
396#define SSS_START_OF_PAM_REQUEST 0x4d415049
397#define SSS_END_OF_PAM_REQUEST 0x4950414d
398
399#define PAM_PREAUTH_INDICATOR PUBCONF_PATH"/pam_preauth_available"
400
401enum pam_item_type {
402 SSS_PAM_ITEM_EMPTY = 0x0000,
403 SSS_PAM_ITEM_USER,
404 SSS_PAM_ITEM_SERVICE,
405 SSS_PAM_ITEM_TTY,
406 SSS_PAM_ITEM_RUSER,
407 SSS_PAM_ITEM_RHOST,
408 SSS_PAM_ITEM_AUTHTOK,
409 SSS_PAM_ITEM_NEWAUTHTOK,
410 SSS_PAM_ITEM_CLI_LOCALE,
411 SSS_PAM_ITEM_CLI_PID,
412 SSS_PAM_ITEM_CHILD_PID,
413 SSS_PAM_ITEM_REQUESTED_DOMAINS,
414 SSS_PAM_ITEM_FLAGS,
415};
416
417#define PAM_CLI_FLAGS_USE_FIRST_PASS (1 << 0)
418#define PAM_CLI_FLAGS_FORWARD_PASS (1 << 1)
419#define PAM_CLI_FLAGS_USE_AUTHTOK (1 << 2)
420#define PAM_CLI_FLAGS_IGNORE_UNKNOWN_USER (1 << 3)
421#define PAM_CLI_FLAGS_IGNORE_AUTHINFO_UNAVAIL (1 << 4)
422#define PAM_CLI_FLAGS_USE_2FA (1 << 5)
423#define PAM_CLI_FLAGS_ALLOW_MISSING_NAME (1 << 6)
424#define PAM_CLI_FLAGS_PROMPT_ALWAYS (1 << 7)
425#define PAM_CLI_FLAGS_TRY_CERT_AUTH (1 << 8)
426#define PAM_CLI_FLAGS_REQUIRE_CERT_AUTH (1 << 9)
427
428#define SSS_NSS_MAX_ENTRIES 256
429#define SSS_NSS_HEADER_SIZE (sizeof(uint32_t) * 4)
430struct sss_cli_req_data {
431 size_t len;
432 const void *data;
433};
434
435/* this is in milliseconds, wait up to 300 seconds */
436#define SSS_CLI_SOCKET_TIMEOUT 300000
437
438enum sss_status {
439 SSS_STATUS_TRYAGAIN,
440 SSS_STATUS_UNAVAIL,
441 SSS_STATUS_SUCCESS
442};
443
475 SSS_PAM_SYSTEM_INFO = 0x01,
512 SSS_OTP,
556};
557
643}; /* end of group user_info_type */
647 /* end of group response_type */
651 /* end of group sss_pam_cli */
655
656
657enum prompt_config_type {
658 PC_TYPE_INVALID = 0,
659 PC_TYPE_PASSWORD,
660 PC_TYPE_2FA,
661 PC_TYPE_2FA_SINGLE,
662 PC_TYPE_PASSKEY,
663 PC_TYPE_SC_PIN,
664 PC_TYPE_LAST
665};
666
667struct prompt_config;
668
669enum prompt_config_type pc_get_type(struct prompt_config *pc);
670const char *pc_get_password_prompt(struct prompt_config *pc);
671const char *pc_get_2fa_1st_prompt(struct prompt_config *pc);
672const char *pc_get_2fa_2nd_prompt(struct prompt_config *pc);
673const char *pc_get_2fa_single_prompt(struct prompt_config *pc);
674const char *pc_get_passkey_inter_prompt(struct prompt_config *pc);
675const char *pc_get_passkey_touch_prompt(struct prompt_config *pc);
676errno_t pc_list_add_passkey(struct prompt_config ***pc_list,
677 const char *inter_prompt,
678 const char *touch_prompt);
679void pc_list_free(struct prompt_config **pc_list);
680errno_t pc_list_add_password(struct prompt_config ***pc_list,
681 const char *prompt);
682errno_t pc_list_add_2fa(struct prompt_config ***pc_list,
683 const char *prompt_1st, const char *prompt_2nd);
684errno_t pc_list_add_2fa_single(struct prompt_config ***pc_list,
685 const char *prompt);
686errno_t pam_get_response_prompt_config(struct prompt_config **pc_list, int *len,
687 uint8_t **data);
688errno_t pc_list_from_response(int size, uint8_t *buf,
689 struct prompt_config ***pc_list);
690
691enum sss_netgr_rep_type {
692 SSS_NETGR_REP_TRIPLE = 1,
693 SSS_NETGR_REP_GROUP
694};
695
696enum sss_cli_error_codes {
697 ESSS_SSS_CLI_ERROR_START = 0x1000,
698 ESSS_BAD_PRIV_SOCKET,
699 ESSS_BAD_PUB_SOCKET,
700 ESSS_BAD_CRED_MSG,
701 ESSS_SERVER_NOT_TRUSTED,
702 ESSS_NO_SOCKET,
703 ESSS_SOCKET_STAT_ERROR,
704
705 ESS_SSS_CLI_ERROR_MAX
706};
707
708const char *ssscli_err2string(int err);
709
710enum sss_status sss_cli_make_request_with_checks(enum sss_cli_command cmd,
711 struct sss_cli_req_data *rd,
712 int timeout,
713 uint8_t **repbuf, size_t *replen,
714 int *errnop,
715 const char *socket_name);
716
717enum nss_status sss_nss_make_request(enum sss_cli_command cmd,
718 struct sss_cli_req_data *rd,
719 uint8_t **repbuf, size_t *replen,
720 int *errnop);
721
722enum nss_status sss_nss_make_request_timeout(enum sss_cli_command cmd,
723 struct sss_cli_req_data *rd,
724 int timeout,
725 uint8_t **repbuf, size_t *replen,
726 int *errnop);
727
728int sss_pam_make_request(enum sss_cli_command cmd,
729 struct sss_cli_req_data *rd,
730 uint8_t **repbuf, size_t *replen,
731 int *errnop);
732
733void sss_cli_close_socket(void);
734
735/* Checks access to the PAC responder and opens the socket, if available.
736 * Required for processes like krb5_child that need to open the socket
737 * before dropping privs.
738 */
739int sss_pac_check_and_open(void);
740
741int sss_pac_make_request(enum sss_cli_command cmd,
742 struct sss_cli_req_data *rd,
743 uint8_t **repbuf, size_t *replen,
744 int *errnop);
745
746int sss_pac_make_request_with_lock(enum sss_cli_command cmd,
747 struct sss_cli_req_data *rd,
748 uint8_t **repbuf, size_t *replen,
749 int *errnop);
750
751int sss_sudo_make_request(enum sss_cli_command cmd,
752 struct sss_cli_req_data *rd,
753 uint8_t **repbuf, size_t *replen,
754 int *errnop);
755
756int sss_autofs_make_request(enum sss_cli_command cmd,
757 struct sss_cli_req_data *rd,
758 uint8_t **repbuf, size_t *replen,
759 int *errnop);
760
761int sss_ssh_make_request(enum sss_cli_command cmd,
762 struct sss_cli_req_data *rd,
763 uint8_t **repbuf, size_t *replen,
764 int *errnop);
765
766#if 0
767
768/* GETSPNAM Request:
769 *
770 * 0-X: string with name
771 *
772 * Replies:
773 *
774 * 0-3: 32bit unsigned number of results
775 * 4-7: 32bit unsigned (reserved/padding)
776 * For each result:
777 * 0-7: 64bit unsigned with Date of last change
778 * 8-15: 64bit unsigned with Min #days between changes
779 * 16-23: 64bit unsigned with Max #days between changes
780 * 24-31: 64bit unsigned with #days before pwd expires
781 * 32-39: 64bit unsigned with #days after pwd expires until account is disabled
782 * 40-47: 64bit unsigned with expiration date in days since 1970-01-01
783 * 48-55: 64bit unsigned (flags/reserved)
784 * 56-X: sequence of 2, 0 terminated, strings (name, pwd) 64bit padded
785 */
786#endif
787
788/* Return strlen(str) or maxlen, whichever is shorter
789 * Returns EINVAL if str is NULL, EFBIG if str is longer than maxlen
790 * _len will return the result
791 */
792errno_t sss_strnlen(const char *str, size_t maxlen, size_t *len);
793
794void sss_nss_lock(void);
795void sss_nss_unlock(void);
796void sss_pam_lock(void);
797void sss_pam_unlock(void);
798void sss_nss_mc_lock(void);
799void sss_nss_mc_unlock(void);
800void sss_pac_lock(void);
801void sss_pac_unlock(void);
802
803errno_t sss_readrep_copy_string(const char *in,
804 size_t *offset,
805 size_t *slen,
806 size_t *dlen,
807 char **out,
808 size_t *size);
809
810enum pam_gssapi_cmd {
811 PAM_GSSAPI_GET_NAME,
812 PAM_GSSAPI_INIT,
813 PAM_GSSAPI_SENTINEL
814};
815
816#endif /* _SSSCLI_H */
response_type
Types of different messages.
Definition: sss_cli.h:474
@ SSS_PAM_TEXT_MSG
A plain text message which should be displayed to the user.
Definition: sss_cli.h:495
@ SSS_CHILD_KEEP_ALIVE
Indicates that the child process is kept alived and further communication must be done with the same ...
Definition: sss_cli.h:532
@ SSS_PASSWORD_PROMPTING
Indicates that password prompting is possible.
Definition: sss_cli.h:515
@ SSS_PAM_ENV_ITEM
Set and environment variable with pam_putenv(3).
Definition: sss_cli.h:481
@ SSS_PAM_CERT_INFO
A message indicating that Smartcard/certificate based authentication is available and contains detail...
Definition: sss_cli.h:505
@ SSS_PAM_CERT_INFO_WITH_HINT
Same as SSS_PAM_CERT_INFO but user name might be missing and should be prompted for.
Definition: sss_cli.h:526
@ SSS_ENV_ITEM
Set and environment variable with putenv(3).
Definition: sss_cli.h:484
@ SSS_PAM_SYSTEM_INFO
Message for the system log.
Definition: sss_cli.h:475
@ SSS_CERT_AUTH_PROMPTING
Indicates that on the server side Smartcard/certificate based authentication is available for the sel...
Definition: sss_cli.h:520
@ SSS_PAM_PROMPT_CONFIG
Contains data which controls which credentials are expected and how the user is prompted for them.
Definition: sss_cli.h:529
@ SSS_PAM_PASSKEY_INFO
Indicates that passkey authentication is available.
Definition: sss_cli.h:543
@ SSS_PAM_OTP_INFO
A message which optionally may contain the name of the vendor, the ID of an OTP token and a challenge...
Definition: sss_cli.h:499
@ SSS_PAM_USER_INFO
A message which should be displayed to the user.
Definition: sss_cli.h:492
@ SSS_PAM_PASSKEY_KRB_INFO
A message containing the passkey parameters for the user.
Definition: sss_cli.h:549
@ SSS_OTP
Indicates that the authtok was a OTP, so don't cache it.
Definition: sss_cli.h:512
@ SSS_PAM_OAUTH2_INFO
A message which contains the oauth2 parameters for the user.
Definition: sss_cli.h:536
@ SSS_ALL_ENV_ITEM
Set and environment variable with putenv(3) and pam_putenv(3).
Definition: sss_cli.h:487
@ SSS_PAM_DOMAIN_NAME
Name of the domain the user belongs too.
Definition: sss_cli.h:477
sss_authtok_type
The different types of authentication tokens.
Definition: sss_cli.h:353
@ SSS_AUTHTOK_TYPE_PASSKEY_REPLY
Authentication token contains Passkey reply data presented as a kerberos challenge answer.
Definition: sss_cli.h:387
@ SSS_AUTHTOK_TYPE_2FA
Authentication token has two factors, they may or may no contain a trailing \0.
Definition: sss_cli.h:363
@ SSS_AUTHTOK_TYPE_SC_PIN
Authentication token is a Smart Card PIN, it may or may no contain a trailing \0.
Definition: sss_cli.h:366
@ SSS_AUTHTOK_TYPE_PASSWORD
Authentication token is a password, it may or may no contain a trailing \0.
Definition: sss_cli.h:356
@ SSS_AUTHTOK_TYPE_SC_KEYPAD
Authentication token indicates Smart Card authentication is used and that the PIN will be entered at ...
Definition: sss_cli.h:369
@ SSS_AUTHTOK_TYPE_2FA_SINGLE
Authentication token has two factors in a single string, it may or may no contain a trailing \0.
Definition: sss_cli.h:373
@ SSS_AUTHTOK_TYPE_PASSKEY
Authentication token is a Passkey PIN, it may or may not contain a trailing \0.
Definition: sss_cli.h:381
@ SSS_AUTHTOK_TYPE_CCFILE
Authentication token is a path to a Kerberos credential cache file, it may or may no contain a traili...
Definition: sss_cli.h:359
@ SSS_AUTHTOK_TYPE_PASSKEY_KRB
Authentication token contains Passkey data used for Kerberos pre-authentication.
Definition: sss_cli.h:384
@ SSS_AUTHTOK_TYPE_OAUTH2
Authentication token is a oauth2 token for presented challenge that is acquired from Kerberos.
Definition: sss_cli.h:376
@ SSS_AUTHTOK_TYPE_EMPTY
No authentication token available.
Definition: sss_cli.h:354
sss_cli_command
The allowed commands an SSS client can send to the SSSD.
Definition: sss_cli.h:67
@ SSS_GSSAPI_SEC_CTX
Establish GSSAPI security ctx.
Definition: sss_cli.h:236
@ SSS_NSS_GETLISTBYCERT
Takes the zero terminated string of the base64 encoded DER representation of a X509 certificate and r...
Definition: sss_cli.h:273
@ SSS_NSS_GETORIGBYGROUPNAME
Takes a zero terminated fully qualified group name and returns a list of zero terminated strings with...
Definition: sss_cli.h:293
@ SSS_PAM_OPEN_SESSION
see pam_sm_open_session(3) for details
Definition: sss_cli.h:215
@ SSS_PAM_SETCRED
see pam_sm_setcred(3) for details
Definition: sss_cli.h:211
@ SSS_NSS_GETIDBYSID
Takes the zero terminated string representation of a SID and returns and returns the POSIX ID of the ...
Definition: sss_cli.h:254
@ SSS_PAM_CLOSE_SESSION
see pam_sm_close_session(3) for details
Definition: sss_cli.h:217
@ SSS_NSS_GET_SUBID_RANGES
Requests both subuid and subgid ranges defined for a user.
Definition: sss_cli.h:311
@ SSS_NSS_GETORIGBYNAME
Takes a zero terminated fully qualified name and returns a list of zero terminated strings with key-v...
Definition: sss_cli.h:261
@ SSS_NSS_GETORIGBYUSERNAME
Takes a zero terminated fully qualified user name and returns a list of zero terminated strings with ...
Definition: sss_cli.h:286
@ SSS_GSSAPI_INIT
Initialize GSSAPI authentication.
Definition: sss_cli.h:235
@ SSS_PAM_ACCT_MGMT
see pam_sm_acct_mgmt(3) for details
Definition: sss_cli.h:213
@ SSS_NSS_GETSIDBYUSERNAME
Takes a zero terminated fully qualified name and returns the zero terminated string representation of...
Definition: sss_cli.h:300
@ SSS_CMD_RENEW
Renew a credential with a limited lifetime, e.g.
Definition: sss_cli.h:228
@ SSS_PAM_AUTHENTICATE
see pam_sm_authenticate(3) for details.
Definition: sss_cli.h:190
@ SSS_PAM_CHAUTHTOK
second run of the password change operation where the PAM_UPDATE_AUTHTOK flag is set and the real cha...
Definition: sss_cli.h:219
@ SSS_NSS_GETSIDBYNAME
Takes a zero terminated fully qualified name and returns the zero terminated string representation of...
Definition: sss_cli.h:242
@ SSS_NSS_GETSIDBYUID
Takes an unsigned 32bit integer (POSIX UID) and return the zero terminated string representation of t...
Definition: sss_cli.h:278
@ SSS_NSS_GETNAMEBYCERT
Takes the zero terminated string of the base64 encoded DER representation of a X509 certificate and r...
Definition: sss_cli.h:268
@ SSS_NSS_GETSIDBYGROUPNAME
Takes a zero terminated fully qualified name and returns the zero terminated string representation of...
Definition: sss_cli.h:304
@ SSS_PAM_PREAUTH
Request which can be run before an authentication request to find out which authentication methods ar...
Definition: sss_cli.h:231
@ SSS_NSS_GETSIDBYID
Takes an unsigned 32bit integer (POSIX ID) and returns the zero terminated string representation of t...
Definition: sss_cli.h:246
@ SSS_NSS_GETSIDBYGID
Takes an unsigned 32bit integer (POSIX GID) and return the zero terminated string representation of t...
Definition: sss_cli.h:282
@ SSS_PAM_CHAUTHTOK_PRELIM
first run of the password change operation where the PAM_PRELIM_CHECK flag is set,...
Definition: sss_cli.h:224
@ SSS_NSS_GETNAMEBYSID
Takes the zero terminated string representation of a SID and returns the zero terminated fully qualif...
Definition: sss_cli.h:250
user_info_type
Different types of user messages.
Definition: sss_cli.h:584
@ SSS_PAM_USER_INFO_CHPASS_ERROR
Tell the user that a password change failed and optionally give a reason.
Definition: sss_cli.h:612
@ SSS_PAM_USER_INFO_OFFLINE_AUTH_DELAYED
Tell the user how low a new authentication is delayed.
Definition: sss_cli.h:596
@ SSS_PAM_USER_INFO_OTP_CHPASS
Tell the user that he needs to kinit or login and logout to get a TGT after an OTP password change.
Definition: sss_cli.h:609
@ SSS_PAM_USER_INFO_OFFLINE_CHPASS
Definition: sss_cli.h:605
@ SSS_PAM_USER_INFO_EXPIRE_WARN
Warn the user that the password will expire soon.
Definition: sss_cli.h:625
@ SSS_PAM_USER_INFO_ACCOUNT_EXPIRED
Tell the user that the account has expired and optionally give a reason.
Definition: sss_cli.h:630
@ SSS_PAM_USER_INFO_NO_KRB_TGT
Tell the user that Kerberos local/offline auth was performed, therefore no TGT is granted.
Definition: sss_cli.h:640
@ SSS_PAM_USER_INFO_PIN_LOCKED
Tell the user that the PIN is locked.
Definition: sss_cli.h:639
@ SSS_PAM_USER_INFO_GRACE_LOGIN
Warn the user that the password is expired and inform about the remaining number of grace logins.
Definition: sss_cli.h:620
@ SSS_PAM_USER_INFO_OFFLINE_AUTH
Inform the user that the authentication happened offline.
Definition: sss_cli.h:585