diff --git a/cmd/authd/daemon/daemon.go b/cmd/authd/daemon/daemon.go index b4cd2a4655..a7aaed4c9a 100644 --- a/cmd/authd/daemon/daemon.go +++ b/cmd/authd/daemon/daemon.go @@ -10,6 +10,7 @@ import ( "github.com/canonical/authd/internal/daemon" "github.com/canonical/authd/internal/decorate" "github.com/canonical/authd/internal/services" + "github.com/canonical/authd/internal/services/pam" "github.com/canonical/authd/internal/users" "github.com/canonical/authd/log" "github.com/spf13/cobra" @@ -46,6 +47,7 @@ type daemonConfig struct { Verbosity int Paths systemPaths UsersConfig *users.Config `mapstructure:",squash" yaml:",inline"` + PAMConfig *pam.Config `mapstructure:",squash" yaml:",inline"` } type options struct { @@ -91,6 +93,7 @@ func New(args ...Option) *App { Socket: "", }, UsersConfig: &users.DefaultConfig, + PAMConfig: &pam.DefaultConfig, } // Install and unmarshall configuration @@ -152,7 +155,12 @@ func (a *App) serve(config daemonConfig) error { panic("Users config must be set! This is a programmer error.") } - m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig) + if config.PAMConfig == nil { + // This is an assert, since we assume that the daemonConfig on [New] is properly defined. + panic("PAM config must be set! This is a programmer error.") + } + + m, err := services.NewManager(ctx, dbDir, config.Paths.BrokersConf, config.Brokers, *config.UsersConfig, *config.PAMConfig) if err != nil { close(a.ready) return err diff --git a/debian/authd-config/authd.yaml b/debian/authd-config/authd.yaml index 42e127ef55..66cb8d0902 100644 --- a/debian/authd-config/authd.yaml +++ b/debian/authd-config/authd.yaml @@ -22,3 +22,20 @@ #UID_MAX: 60000 #GID_MIN: 10000 #GID_MAX: 60000 + +## Brute-force mitigation settings for authentication failures. +## To disable brute-force mitigation entirely, set auth_fail_delay to 0. +## +## auth_fail_delay_threshold: number of consecutive failures for a single user +## before a delay is imposed on subsequent attempts. +#auth_fail_delay_threshold: 3 +## +## auth_fail_delay: duration of the delay imposed once the threshold is reached. +## Accepts durations like "2s", "500ms", "1m". +#auth_fail_delay: 2s +## +## auth_fail_reset_window: duration of inactivity after the last failure before +## the failure count is automatically reset. +## Accepts durations like "15m", "1h", "30s". Set to 0 to keep failures +## accumulated indefinitely (no inactivity reset). +#auth_fail_reset_window: 15m diff --git a/internal/brokers/manager.go b/internal/brokers/manager.go index debd779c31..f49290375e 100644 --- a/internal/brokers/manager.go +++ b/internal/brokers/manager.go @@ -26,6 +26,7 @@ type Manager struct { usersToBrokerMu sync.RWMutex transactionsToBroker map[string]*Broker + sessionsToUsername map[string]string transactionsToBrokerMu sync.RWMutex cleanup func() @@ -112,6 +113,7 @@ func NewManager(ctx context.Context, brokersConfPath string, configuredBrokers [ usersToBroker: make(map[string]*Broker), transactionsToBroker: make(map[string]*Broker), + sessionsToUsername: make(map[string]string), cleanup: cleanup, }, nil @@ -180,6 +182,7 @@ func (m *Manager) NewSession(brokerID, username, lang, mode, providerID string) log.Debugf(context.Background(), "%s: New %s session for %q", sessionID, mode, username) m.transactionsToBroker[sessionID] = broker + m.sessionsToUsername[sessionID] = username return sessionID, encryptionKey, nil } @@ -197,12 +200,20 @@ func (m *Manager) EndSession(sessionID string) error { m.transactionsToBrokerMu.Lock() log.Debugf(context.Background(), "%s: End session %q", - sessionID, m.transactionsToBroker[sessionID].Name) + sessionID, b.Name) delete(m.transactionsToBroker, sessionID) + delete(m.sessionsToUsername, sessionID) m.transactionsToBrokerMu.Unlock() return nil } +// UsernameFromSessionID returns the username associated with the given session ID. +func (m *Manager) UsernameFromSessionID(sessionID string) string { + m.transactionsToBrokerMu.RLock() + defer m.transactionsToBrokerMu.RUnlock() + return m.sessionsToUsername[sessionID] +} + // BrokerExists returns true if the brokerID is known by the manager. func (m *Manager) BrokerExists(brokerID string) bool { _, exists := m.brokers[brokerID] diff --git a/internal/proto/authd/authd.pb.go b/internal/proto/authd/authd.pb.go index bb6f26a887..c92111a902 100644 --- a/internal/proto/authd/authd.pb.go +++ b/internal/proto/authd/authd.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.7 -// protoc v3.21.12 +// protoc-gen-go v1.36.10 +// protoc v6.33.1 // source: authd.proto package authd @@ -801,58 +801,6 @@ func (x *IAResponse) GetMsg() string { return "" } -type STBRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - BrokerId string `protobuf:"bytes,1,opt,name=broker_id,json=brokerId,proto3" json:"broker_id,omitempty"` - Username string `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *STBRequest) Reset() { - *x = STBRequest{} - mi := &file_authd_proto_msgTypes[14] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *STBRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*STBRequest) ProtoMessage() {} - -func (x *STBRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[14] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use STBRequest.ProtoReflect.Descriptor instead. -func (*STBRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{14} -} - -func (x *STBRequest) GetBrokerId() string { - if x != nil { - return x.BrokerId - } - return "" -} - -func (x *STBRequest) GetUsername() string { - if x != nil { - return x.Username - } - return "" -} - type ESRequest struct { state protoimpl.MessageState `protogen:"open.v1"` SessionId string `protobuf:"bytes,1,opt,name=session_id,json=sessionId,proto3" json:"session_id,omitempty"` @@ -862,7 +810,7 @@ type ESRequest struct { func (x *ESRequest) Reset() { *x = ESRequest{} - mi := &file_authd_proto_msgTypes[15] + mi := &file_authd_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -874,7 +822,7 @@ func (x *ESRequest) String() string { func (*ESRequest) ProtoMessage() {} func (x *ESRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[15] + mi := &file_authd_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -887,7 +835,7 @@ func (x *ESRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ESRequest.ProtoReflect.Descriptor instead. func (*ESRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{15} + return file_authd_proto_rawDescGZIP(), []int{14} } func (x *ESRequest) GetSessionId() string { @@ -907,7 +855,7 @@ type GetUserByNameRequest struct { func (x *GetUserByNameRequest) Reset() { *x = GetUserByNameRequest{} - mi := &file_authd_proto_msgTypes[16] + mi := &file_authd_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -919,7 +867,7 @@ func (x *GetUserByNameRequest) String() string { func (*GetUserByNameRequest) ProtoMessage() {} func (x *GetUserByNameRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[16] + mi := &file_authd_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -932,7 +880,7 @@ func (x *GetUserByNameRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetUserByNameRequest.ProtoReflect.Descriptor instead. func (*GetUserByNameRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{16} + return file_authd_proto_rawDescGZIP(), []int{15} } func (x *GetUserByNameRequest) GetName() string { @@ -958,7 +906,7 @@ type GetUserByIDRequest struct { func (x *GetUserByIDRequest) Reset() { *x = GetUserByIDRequest{} - mi := &file_authd_proto_msgTypes[17] + mi := &file_authd_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -970,7 +918,7 @@ func (x *GetUserByIDRequest) String() string { func (*GetUserByIDRequest) ProtoMessage() {} func (x *GetUserByIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[17] + mi := &file_authd_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -983,7 +931,7 @@ func (x *GetUserByIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetUserByIDRequest.ProtoReflect.Descriptor instead. func (*GetUserByIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{17} + return file_authd_proto_rawDescGZIP(), []int{16} } func (x *GetUserByIDRequest) GetId() uint32 { @@ -1002,7 +950,7 @@ type LockUserRequest struct { func (x *LockUserRequest) Reset() { *x = LockUserRequest{} - mi := &file_authd_proto_msgTypes[18] + mi := &file_authd_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1014,7 +962,7 @@ func (x *LockUserRequest) String() string { func (*LockUserRequest) ProtoMessage() {} func (x *LockUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[18] + mi := &file_authd_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1027,7 +975,7 @@ func (x *LockUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use LockUserRequest.ProtoReflect.Descriptor instead. func (*LockUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{18} + return file_authd_proto_rawDescGZIP(), []int{17} } func (x *LockUserRequest) GetName() string { @@ -1046,7 +994,7 @@ type UnlockUserRequest struct { func (x *UnlockUserRequest) Reset() { *x = UnlockUserRequest{} - mi := &file_authd_proto_msgTypes[19] + mi := &file_authd_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1058,7 +1006,7 @@ func (x *UnlockUserRequest) String() string { func (*UnlockUserRequest) ProtoMessage() {} func (x *UnlockUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[19] + mi := &file_authd_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1071,7 +1019,7 @@ func (x *UnlockUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UnlockUserRequest.ProtoReflect.Descriptor instead. func (*UnlockUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{19} + return file_authd_proto_rawDescGZIP(), []int{18} } func (x *UnlockUserRequest) GetName() string { @@ -1092,7 +1040,7 @@ type DeleteUserRequest struct { func (x *DeleteUserRequest) Reset() { *x = DeleteUserRequest{} - mi := &file_authd_proto_msgTypes[20] + mi := &file_authd_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1104,7 +1052,7 @@ func (x *DeleteUserRequest) String() string { func (*DeleteUserRequest) ProtoMessage() {} func (x *DeleteUserRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[20] + mi := &file_authd_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1117,7 +1065,7 @@ func (x *DeleteUserRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteUserRequest.ProtoReflect.Descriptor instead. func (*DeleteUserRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{20} + return file_authd_proto_rawDescGZIP(), []int{19} } func (x *DeleteUserRequest) GetName() string { @@ -1143,7 +1091,7 @@ type DeleteGroupRequest struct { func (x *DeleteGroupRequest) Reset() { *x = DeleteGroupRequest{} - mi := &file_authd_proto_msgTypes[21] + mi := &file_authd_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1155,7 +1103,7 @@ func (x *DeleteGroupRequest) String() string { func (*DeleteGroupRequest) ProtoMessage() {} func (x *DeleteGroupRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[21] + mi := &file_authd_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1168,7 +1116,7 @@ func (x *DeleteGroupRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteGroupRequest.ProtoReflect.Descriptor instead. func (*DeleteGroupRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{21} + return file_authd_proto_rawDescGZIP(), []int{20} } func (x *DeleteGroupRequest) GetName() string { @@ -1187,7 +1135,7 @@ type GetGroupByNameRequest struct { func (x *GetGroupByNameRequest) Reset() { *x = GetGroupByNameRequest{} - mi := &file_authd_proto_msgTypes[22] + mi := &file_authd_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1199,7 +1147,7 @@ func (x *GetGroupByNameRequest) String() string { func (*GetGroupByNameRequest) ProtoMessage() {} func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[22] + mi := &file_authd_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1212,7 +1160,7 @@ func (x *GetGroupByNameRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetGroupByNameRequest.ProtoReflect.Descriptor instead. func (*GetGroupByNameRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{22} + return file_authd_proto_rawDescGZIP(), []int{21} } func (x *GetGroupByNameRequest) GetName() string { @@ -1231,7 +1179,7 @@ type GetGroupByIDRequest struct { func (x *GetGroupByIDRequest) Reset() { *x = GetGroupByIDRequest{} - mi := &file_authd_proto_msgTypes[23] + mi := &file_authd_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1243,7 +1191,7 @@ func (x *GetGroupByIDRequest) String() string { func (*GetGroupByIDRequest) ProtoMessage() {} func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[23] + mi := &file_authd_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1256,7 +1204,7 @@ func (x *GetGroupByIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetGroupByIDRequest.ProtoReflect.Descriptor instead. func (*GetGroupByIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{23} + return file_authd_proto_rawDescGZIP(), []int{22} } func (x *GetGroupByIDRequest) GetId() uint32 { @@ -1279,7 +1227,7 @@ type SetUserIDRequest struct { func (x *SetUserIDRequest) Reset() { *x = SetUserIDRequest{} - mi := &file_authd_proto_msgTypes[24] + mi := &file_authd_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1291,7 +1239,7 @@ func (x *SetUserIDRequest) String() string { func (*SetUserIDRequest) ProtoMessage() {} func (x *SetUserIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[24] + mi := &file_authd_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1304,7 +1252,7 @@ func (x *SetUserIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetUserIDRequest.ProtoReflect.Descriptor instead. func (*SetUserIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{24} + return file_authd_proto_rawDescGZIP(), []int{23} } func (x *SetUserIDRequest) GetName() string { @@ -1339,7 +1287,7 @@ type SetUserIDResponse struct { func (x *SetUserIDResponse) Reset() { *x = SetUserIDResponse{} - mi := &file_authd_proto_msgTypes[25] + mi := &file_authd_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1351,7 +1299,7 @@ func (x *SetUserIDResponse) String() string { func (*SetUserIDResponse) ProtoMessage() {} func (x *SetUserIDResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[25] + mi := &file_authd_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1364,7 +1312,7 @@ func (x *SetUserIDResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetUserIDResponse.ProtoReflect.Descriptor instead. func (*SetUserIDResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{25} + return file_authd_proto_rawDescGZIP(), []int{24} } func (x *SetUserIDResponse) GetIdChanged() bool { @@ -1401,7 +1349,7 @@ type SetGroupIDRequest struct { func (x *SetGroupIDRequest) Reset() { *x = SetGroupIDRequest{} - mi := &file_authd_proto_msgTypes[26] + mi := &file_authd_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1413,7 +1361,7 @@ func (x *SetGroupIDRequest) String() string { func (*SetGroupIDRequest) ProtoMessage() {} func (x *SetGroupIDRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[26] + mi := &file_authd_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1426,7 +1374,7 @@ func (x *SetGroupIDRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetGroupIDRequest.ProtoReflect.Descriptor instead. func (*SetGroupIDRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{26} + return file_authd_proto_rawDescGZIP(), []int{25} } func (x *SetGroupIDRequest) GetName() string { @@ -1461,7 +1409,7 @@ type SetGroupIDResponse struct { func (x *SetGroupIDResponse) Reset() { *x = SetGroupIDResponse{} - mi := &file_authd_proto_msgTypes[27] + mi := &file_authd_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1473,7 +1421,7 @@ func (x *SetGroupIDResponse) String() string { func (*SetGroupIDResponse) ProtoMessage() {} func (x *SetGroupIDResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[27] + mi := &file_authd_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1486,7 +1434,7 @@ func (x *SetGroupIDResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetGroupIDResponse.ProtoReflect.Descriptor instead. func (*SetGroupIDResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{27} + return file_authd_proto_rawDescGZIP(), []int{26} } func (x *SetGroupIDResponse) GetIdChanged() bool { @@ -1520,7 +1468,7 @@ type SetShellRequest struct { func (x *SetShellRequest) Reset() { *x = SetShellRequest{} - mi := &file_authd_proto_msgTypes[28] + mi := &file_authd_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1532,7 +1480,7 @@ func (x *SetShellRequest) String() string { func (*SetShellRequest) ProtoMessage() {} func (x *SetShellRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[28] + mi := &file_authd_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1545,7 +1493,7 @@ func (x *SetShellRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetShellRequest.ProtoReflect.Descriptor instead. func (*SetShellRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{28} + return file_authd_proto_rawDescGZIP(), []int{27} } func (x *SetShellRequest) GetName() string { @@ -1571,7 +1519,7 @@ type SetShellResponse struct { func (x *SetShellResponse) Reset() { *x = SetShellResponse{} - mi := &file_authd_proto_msgTypes[29] + mi := &file_authd_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1583,7 +1531,7 @@ func (x *SetShellResponse) String() string { func (*SetShellResponse) ProtoMessage() {} func (x *SetShellResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[29] + mi := &file_authd_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1596,7 +1544,7 @@ func (x *SetShellResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetShellResponse.ProtoReflect.Descriptor instead. func (*SetShellResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{29} + return file_authd_proto_rawDescGZIP(), []int{28} } func (x *SetShellResponse) GetWarnings() []string { @@ -1616,7 +1564,7 @@ type SetHomeDirRequest struct { func (x *SetHomeDirRequest) Reset() { *x = SetHomeDirRequest{} - mi := &file_authd_proto_msgTypes[30] + mi := &file_authd_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1628,7 +1576,7 @@ func (x *SetHomeDirRequest) String() string { func (*SetHomeDirRequest) ProtoMessage() {} func (x *SetHomeDirRequest) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[30] + mi := &file_authd_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1641,7 +1589,7 @@ func (x *SetHomeDirRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SetHomeDirRequest.ProtoReflect.Descriptor instead. func (*SetHomeDirRequest) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{30} + return file_authd_proto_rawDescGZIP(), []int{29} } func (x *SetHomeDirRequest) GetName() string { @@ -1669,7 +1617,7 @@ type SetHomeDirResponse struct { func (x *SetHomeDirResponse) Reset() { *x = SetHomeDirResponse{} - mi := &file_authd_proto_msgTypes[31] + mi := &file_authd_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1681,7 +1629,7 @@ func (x *SetHomeDirResponse) String() string { func (*SetHomeDirResponse) ProtoMessage() {} func (x *SetHomeDirResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[31] + mi := &file_authd_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1694,7 +1642,7 @@ func (x *SetHomeDirResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SetHomeDirResponse.ProtoReflect.Descriptor instead. func (*SetHomeDirResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{31} + return file_authd_proto_rawDescGZIP(), []int{30} } func (x *SetHomeDirResponse) GetHomeDirChanged() bool { @@ -1727,7 +1675,7 @@ type DeleteUserResponse struct { func (x *DeleteUserResponse) Reset() { *x = DeleteUserResponse{} - mi := &file_authd_proto_msgTypes[32] + mi := &file_authd_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1739,7 +1687,7 @@ func (x *DeleteUserResponse) String() string { func (*DeleteUserResponse) ProtoMessage() {} func (x *DeleteUserResponse) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[32] + mi := &file_authd_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1752,7 +1700,7 @@ func (x *DeleteUserResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteUserResponse.ProtoReflect.Descriptor instead. func (*DeleteUserResponse) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{32} + return file_authd_proto_rawDescGZIP(), []int{31} } func (x *DeleteUserResponse) GetWarnings() []string { @@ -1776,7 +1724,7 @@ type User struct { func (x *User) Reset() { *x = User{} - mi := &file_authd_proto_msgTypes[33] + mi := &file_authd_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1788,7 +1736,7 @@ func (x *User) String() string { func (*User) ProtoMessage() {} func (x *User) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[33] + mi := &file_authd_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1801,7 +1749,7 @@ func (x *User) ProtoReflect() protoreflect.Message { // Deprecated: Use User.ProtoReflect.Descriptor instead. func (*User) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{33} + return file_authd_proto_rawDescGZIP(), []int{32} } func (x *User) GetName() string { @@ -1855,7 +1803,7 @@ type Users struct { func (x *Users) Reset() { *x = Users{} - mi := &file_authd_proto_msgTypes[34] + mi := &file_authd_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1867,7 +1815,7 @@ func (x *Users) String() string { func (*Users) ProtoMessage() {} func (x *Users) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[34] + mi := &file_authd_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1880,7 +1828,7 @@ func (x *Users) ProtoReflect() protoreflect.Message { // Deprecated: Use Users.ProtoReflect.Descriptor instead. func (*Users) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{34} + return file_authd_proto_rawDescGZIP(), []int{33} } func (x *Users) GetUsers() []*User { @@ -1903,7 +1851,7 @@ type Group struct { func (x *Group) Reset() { *x = Group{} - mi := &file_authd_proto_msgTypes[35] + mi := &file_authd_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1915,7 +1863,7 @@ func (x *Group) String() string { func (*Group) ProtoMessage() {} func (x *Group) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[35] + mi := &file_authd_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1928,7 +1876,7 @@ func (x *Group) ProtoReflect() protoreflect.Message { // Deprecated: Use Group.ProtoReflect.Descriptor instead. func (*Group) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{35} + return file_authd_proto_rawDescGZIP(), []int{34} } func (x *Group) GetName() string { @@ -1968,7 +1916,7 @@ type Groups struct { func (x *Groups) Reset() { *x = Groups{} - mi := &file_authd_proto_msgTypes[36] + mi := &file_authd_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1980,7 +1928,7 @@ func (x *Groups) String() string { func (*Groups) ProtoMessage() {} func (x *Groups) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[36] + mi := &file_authd_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1993,7 +1941,7 @@ func (x *Groups) ProtoReflect() protoreflect.Message { // Deprecated: Use Groups.ProtoReflect.Descriptor instead. func (*Groups) Descriptor() ([]byte, []int) { - return file_authd_proto_rawDescGZIP(), []int{36} + return file_authd_proto_rawDescGZIP(), []int{35} } func (x *Groups) GetGroups() []*Group { @@ -2014,7 +1962,7 @@ type ABResponse_BrokerInfo struct { func (x *ABResponse_BrokerInfo) Reset() { *x = ABResponse_BrokerInfo{} - mi := &file_authd_proto_msgTypes[37] + mi := &file_authd_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2026,7 +1974,7 @@ func (x *ABResponse_BrokerInfo) String() string { func (*ABResponse_BrokerInfo) ProtoMessage() {} func (x *ABResponse_BrokerInfo) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[37] + mi := &file_authd_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2073,7 +2021,7 @@ type GAMResponse_AuthenticationMode struct { func (x *GAMResponse_AuthenticationMode) Reset() { *x = GAMResponse_AuthenticationMode{} - mi := &file_authd_proto_msgTypes[38] + mi := &file_authd_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2085,7 +2033,7 @@ func (x *GAMResponse_AuthenticationMode) String() string { func (*GAMResponse_AuthenticationMode) ProtoMessage() {} func (x *GAMResponse_AuthenticationMode) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[38] + mi := &file_authd_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2130,7 +2078,7 @@ type IARequest_AuthenticationData struct { func (x *IARequest_AuthenticationData) Reset() { *x = IARequest_AuthenticationData{} - mi := &file_authd_proto_msgTypes[39] + mi := &file_authd_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2142,7 +2090,7 @@ func (x *IARequest_AuthenticationData) String() string { func (*IARequest_AuthenticationData) ProtoMessage() {} func (x *IARequest_AuthenticationData) ProtoReflect() protoreflect.Message { - mi := &file_authd_proto_msgTypes[39] + mi := &file_authd_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2310,11 +2258,7 @@ const file_authd_proto_rawDesc = "" + "\n" + "IAResponse\x12\x16\n" + "\x06access\x18\x01 \x01(\tR\x06access\x12\x10\n" + - "\x03msg\x18\x02 \x01(\tR\x03msg\"E\n" + - "\n" + - "STBRequest\x12\x1b\n" + - "\tbroker_id\x18\x01 \x01(\tR\bbrokerId\x12\x1a\n" + - "\busername\x18\x02 \x01(\tR\busername\"*\n" + + "\x03msg\x18\x02 \x01(\tR\x03msg\"*\n" + "\tESRequest\x12\x1d\n" + "\n" + "session_id\x18\x01 \x01(\tR\tsessionId\"R\n" + @@ -2388,7 +2332,7 @@ const file_authd_proto_rawDesc = "" + "\vSessionMode\x12\r\n" + "\tUNDEFINED\x10\x00\x12\t\n" + "\x05LOGIN\x10\x01\x12\x13\n" + - "\x0fCHANGE_PASSWORD\x10\x022\xb9\x03\n" + + "\x0fCHANGE_PASSWORD\x10\x022\x8b\x03\n" + "\x03PAM\x123\n" + "\x10AvailableBrokers\x12\f.authd.Empty\x1a\x11.authd.ABResponse\x120\n" + "\tGetBroker\x12\x10.authd.GBRequest\x1a\x11.authd.GBResponse\x123\n" + @@ -2397,8 +2341,7 @@ const file_authd_proto_rawDesc = "" + "\x18SelectAuthenticationMode\x12\x11.authd.SAMRequest\x1a\x12.authd.SAMResponse\x126\n" + "\x0fIsAuthenticated\x12\x10.authd.IARequest\x1a\x11.authd.IAResponse\x12,\n" + "\n" + - "EndSession\x12\x10.authd.ESRequest\x1a\f.authd.Empty\x12,\n" + - "\tSetBroker\x12\x11.authd.STBRequest\x1a\f.authd.Empty2\xb1\x06\n" + + "EndSession\x12\x10.authd.ESRequest\x1a\f.authd.Empty2\xb1\x06\n" + "\vUserService\x129\n" + "\rGetUserByName\x12\x1b.authd.GetUserByNameRequest\x1a\v.authd.User\x125\n" + "\vGetUserByID\x12\x19.authd.GetUserByIDRequest\x1a\v.authd.User\x12'\n" + @@ -2433,7 +2376,7 @@ func file_authd_proto_rawDescGZIP() []byte { } var file_authd_proto_enumTypes = make([]protoimpl.EnumInfo, 1) -var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 40) +var file_authd_proto_msgTypes = make([]protoimpl.MessageInfo, 39) var file_authd_proto_goTypes = []any{ (SessionMode)(0), // 0: authd.SessionMode (*Empty)(nil), // 1: authd.Empty @@ -2450,88 +2393,85 @@ var file_authd_proto_goTypes = []any{ (*SAMResponse)(nil), // 12: authd.SAMResponse (*IARequest)(nil), // 13: authd.IARequest (*IAResponse)(nil), // 14: authd.IAResponse - (*STBRequest)(nil), // 15: authd.STBRequest - (*ESRequest)(nil), // 16: authd.ESRequest - (*GetUserByNameRequest)(nil), // 17: authd.GetUserByNameRequest - (*GetUserByIDRequest)(nil), // 18: authd.GetUserByIDRequest - (*LockUserRequest)(nil), // 19: authd.LockUserRequest - (*UnlockUserRequest)(nil), // 20: authd.UnlockUserRequest - (*DeleteUserRequest)(nil), // 21: authd.DeleteUserRequest - (*DeleteGroupRequest)(nil), // 22: authd.DeleteGroupRequest - (*GetGroupByNameRequest)(nil), // 23: authd.GetGroupByNameRequest - (*GetGroupByIDRequest)(nil), // 24: authd.GetGroupByIDRequest - (*SetUserIDRequest)(nil), // 25: authd.SetUserIDRequest - (*SetUserIDResponse)(nil), // 26: authd.SetUserIDResponse - (*SetGroupIDRequest)(nil), // 27: authd.SetGroupIDRequest - (*SetGroupIDResponse)(nil), // 28: authd.SetGroupIDResponse - (*SetShellRequest)(nil), // 29: authd.SetShellRequest - (*SetShellResponse)(nil), // 30: authd.SetShellResponse - (*SetHomeDirRequest)(nil), // 31: authd.SetHomeDirRequest - (*SetHomeDirResponse)(nil), // 32: authd.SetHomeDirResponse - (*DeleteUserResponse)(nil), // 33: authd.DeleteUserResponse - (*User)(nil), // 34: authd.User - (*Users)(nil), // 35: authd.Users - (*Group)(nil), // 36: authd.Group - (*Groups)(nil), // 37: authd.Groups - (*ABResponse_BrokerInfo)(nil), // 38: authd.ABResponse.BrokerInfo - (*GAMResponse_AuthenticationMode)(nil), // 39: authd.GAMResponse.AuthenticationMode - (*IARequest_AuthenticationData)(nil), // 40: authd.IARequest.AuthenticationData + (*ESRequest)(nil), // 15: authd.ESRequest + (*GetUserByNameRequest)(nil), // 16: authd.GetUserByNameRequest + (*GetUserByIDRequest)(nil), // 17: authd.GetUserByIDRequest + (*LockUserRequest)(nil), // 18: authd.LockUserRequest + (*UnlockUserRequest)(nil), // 19: authd.UnlockUserRequest + (*DeleteUserRequest)(nil), // 20: authd.DeleteUserRequest + (*DeleteGroupRequest)(nil), // 21: authd.DeleteGroupRequest + (*GetGroupByNameRequest)(nil), // 22: authd.GetGroupByNameRequest + (*GetGroupByIDRequest)(nil), // 23: authd.GetGroupByIDRequest + (*SetUserIDRequest)(nil), // 24: authd.SetUserIDRequest + (*SetUserIDResponse)(nil), // 25: authd.SetUserIDResponse + (*SetGroupIDRequest)(nil), // 26: authd.SetGroupIDRequest + (*SetGroupIDResponse)(nil), // 27: authd.SetGroupIDResponse + (*SetShellRequest)(nil), // 28: authd.SetShellRequest + (*SetShellResponse)(nil), // 29: authd.SetShellResponse + (*SetHomeDirRequest)(nil), // 30: authd.SetHomeDirRequest + (*SetHomeDirResponse)(nil), // 31: authd.SetHomeDirResponse + (*DeleteUserResponse)(nil), // 32: authd.DeleteUserResponse + (*User)(nil), // 33: authd.User + (*Users)(nil), // 34: authd.Users + (*Group)(nil), // 35: authd.Group + (*Groups)(nil), // 36: authd.Groups + (*ABResponse_BrokerInfo)(nil), // 37: authd.ABResponse.BrokerInfo + (*GAMResponse_AuthenticationMode)(nil), // 38: authd.GAMResponse.AuthenticationMode + (*IARequest_AuthenticationData)(nil), // 39: authd.IARequest.AuthenticationData } var file_authd_proto_depIdxs = []int32{ - 38, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo + 37, // 0: authd.ABResponse.brokers_infos:type_name -> authd.ABResponse.BrokerInfo 0, // 1: authd.SBRequest.mode:type_name -> authd.SessionMode 9, // 2: authd.GAMRequest.supported_ui_layouts:type_name -> authd.UILayout - 39, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode + 38, // 3: authd.GAMResponse.authentication_modes:type_name -> authd.GAMResponse.AuthenticationMode 9, // 4: authd.SAMResponse.ui_layout_info:type_name -> authd.UILayout - 40, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData - 34, // 6: authd.Users.users:type_name -> authd.User - 36, // 7: authd.Groups.groups:type_name -> authd.Group + 39, // 5: authd.IARequest.authentication_data:type_name -> authd.IARequest.AuthenticationData + 33, // 6: authd.Users.users:type_name -> authd.User + 35, // 7: authd.Groups.groups:type_name -> authd.Group 1, // 8: authd.PAM.AvailableBrokers:input_type -> authd.Empty 2, // 9: authd.PAM.GetBroker:input_type -> authd.GBRequest 6, // 10: authd.PAM.SelectBroker:input_type -> authd.SBRequest 8, // 11: authd.PAM.GetAuthenticationModes:input_type -> authd.GAMRequest 11, // 12: authd.PAM.SelectAuthenticationMode:input_type -> authd.SAMRequest 13, // 13: authd.PAM.IsAuthenticated:input_type -> authd.IARequest - 16, // 14: authd.PAM.EndSession:input_type -> authd.ESRequest - 15, // 15: authd.PAM.SetBroker:input_type -> authd.STBRequest - 17, // 16: authd.UserService.GetUserByName:input_type -> authd.GetUserByNameRequest - 18, // 17: authd.UserService.GetUserByID:input_type -> authd.GetUserByIDRequest - 1, // 18: authd.UserService.ListUsers:input_type -> authd.Empty - 19, // 19: authd.UserService.LockUser:input_type -> authd.LockUserRequest - 20, // 20: authd.UserService.UnlockUser:input_type -> authd.UnlockUserRequest - 25, // 21: authd.UserService.SetUserID:input_type -> authd.SetUserIDRequest - 27, // 22: authd.UserService.SetGroupID:input_type -> authd.SetGroupIDRequest - 29, // 23: authd.UserService.SetShell:input_type -> authd.SetShellRequest - 31, // 24: authd.UserService.SetHomeDir:input_type -> authd.SetHomeDirRequest - 21, // 25: authd.UserService.DeleteUser:input_type -> authd.DeleteUserRequest - 22, // 26: authd.UserService.DeleteGroup:input_type -> authd.DeleteGroupRequest - 23, // 27: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest - 24, // 28: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest - 1, // 29: authd.UserService.ListGroups:input_type -> authd.Empty - 4, // 30: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse - 3, // 31: authd.PAM.GetBroker:output_type -> authd.GBResponse - 7, // 32: authd.PAM.SelectBroker:output_type -> authd.SBResponse - 10, // 33: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse - 12, // 34: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse - 14, // 35: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse - 1, // 36: authd.PAM.EndSession:output_type -> authd.Empty - 1, // 37: authd.PAM.SetBroker:output_type -> authd.Empty - 34, // 38: authd.UserService.GetUserByName:output_type -> authd.User - 34, // 39: authd.UserService.GetUserByID:output_type -> authd.User - 35, // 40: authd.UserService.ListUsers:output_type -> authd.Users - 1, // 41: authd.UserService.LockUser:output_type -> authd.Empty - 1, // 42: authd.UserService.UnlockUser:output_type -> authd.Empty - 26, // 43: authd.UserService.SetUserID:output_type -> authd.SetUserIDResponse - 28, // 44: authd.UserService.SetGroupID:output_type -> authd.SetGroupIDResponse - 30, // 45: authd.UserService.SetShell:output_type -> authd.SetShellResponse - 32, // 46: authd.UserService.SetHomeDir:output_type -> authd.SetHomeDirResponse - 33, // 47: authd.UserService.DeleteUser:output_type -> authd.DeleteUserResponse - 1, // 48: authd.UserService.DeleteGroup:output_type -> authd.Empty - 36, // 49: authd.UserService.GetGroupByName:output_type -> authd.Group - 36, // 50: authd.UserService.GetGroupByID:output_type -> authd.Group - 37, // 51: authd.UserService.ListGroups:output_type -> authd.Groups - 30, // [30:52] is the sub-list for method output_type - 8, // [8:30] is the sub-list for method input_type + 15, // 14: authd.PAM.EndSession:input_type -> authd.ESRequest + 16, // 15: authd.UserService.GetUserByName:input_type -> authd.GetUserByNameRequest + 17, // 16: authd.UserService.GetUserByID:input_type -> authd.GetUserByIDRequest + 1, // 17: authd.UserService.ListUsers:input_type -> authd.Empty + 18, // 18: authd.UserService.LockUser:input_type -> authd.LockUserRequest + 19, // 19: authd.UserService.UnlockUser:input_type -> authd.UnlockUserRequest + 24, // 20: authd.UserService.SetUserID:input_type -> authd.SetUserIDRequest + 26, // 21: authd.UserService.SetGroupID:input_type -> authd.SetGroupIDRequest + 28, // 22: authd.UserService.SetShell:input_type -> authd.SetShellRequest + 30, // 23: authd.UserService.SetHomeDir:input_type -> authd.SetHomeDirRequest + 20, // 24: authd.UserService.DeleteUser:input_type -> authd.DeleteUserRequest + 21, // 25: authd.UserService.DeleteGroup:input_type -> authd.DeleteGroupRequest + 22, // 26: authd.UserService.GetGroupByName:input_type -> authd.GetGroupByNameRequest + 23, // 27: authd.UserService.GetGroupByID:input_type -> authd.GetGroupByIDRequest + 1, // 28: authd.UserService.ListGroups:input_type -> authd.Empty + 4, // 29: authd.PAM.AvailableBrokers:output_type -> authd.ABResponse + 3, // 30: authd.PAM.GetBroker:output_type -> authd.GBResponse + 7, // 31: authd.PAM.SelectBroker:output_type -> authd.SBResponse + 10, // 32: authd.PAM.GetAuthenticationModes:output_type -> authd.GAMResponse + 12, // 33: authd.PAM.SelectAuthenticationMode:output_type -> authd.SAMResponse + 14, // 34: authd.PAM.IsAuthenticated:output_type -> authd.IAResponse + 1, // 35: authd.PAM.EndSession:output_type -> authd.Empty + 33, // 36: authd.UserService.GetUserByName:output_type -> authd.User + 33, // 37: authd.UserService.GetUserByID:output_type -> authd.User + 34, // 38: authd.UserService.ListUsers:output_type -> authd.Users + 1, // 39: authd.UserService.LockUser:output_type -> authd.Empty + 1, // 40: authd.UserService.UnlockUser:output_type -> authd.Empty + 25, // 41: authd.UserService.SetUserID:output_type -> authd.SetUserIDResponse + 27, // 42: authd.UserService.SetGroupID:output_type -> authd.SetGroupIDResponse + 29, // 43: authd.UserService.SetShell:output_type -> authd.SetShellResponse + 31, // 44: authd.UserService.SetHomeDir:output_type -> authd.SetHomeDirResponse + 32, // 45: authd.UserService.DeleteUser:output_type -> authd.DeleteUserResponse + 1, // 46: authd.UserService.DeleteGroup:output_type -> authd.Empty + 35, // 47: authd.UserService.GetGroupByName:output_type -> authd.Group + 35, // 48: authd.UserService.GetGroupByID:output_type -> authd.Group + 36, // 49: authd.UserService.ListGroups:output_type -> authd.Groups + 29, // [29:50] is the sub-list for method output_type + 8, // [8:29] is the sub-list for method input_type 8, // [8:8] is the sub-list for extension type_name 8, // [8:8] is the sub-list for extension extendee 0, // [0:8] is the sub-list for field type_name @@ -2543,8 +2483,8 @@ func file_authd_proto_init() { return } file_authd_proto_msgTypes[8].OneofWrappers = []any{} - file_authd_proto_msgTypes[37].OneofWrappers = []any{} - file_authd_proto_msgTypes[39].OneofWrappers = []any{ + file_authd_proto_msgTypes[36].OneofWrappers = []any{} + file_authd_proto_msgTypes[38].OneofWrappers = []any{ (*IARequest_AuthenticationData_Secret)(nil), (*IARequest_AuthenticationData_Wait)(nil), (*IARequest_AuthenticationData_Skip)(nil), @@ -2556,7 +2496,7 @@ func file_authd_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_authd_proto_rawDesc), len(file_authd_proto_rawDesc)), NumEnums: 1, - NumMessages: 40, + NumMessages: 39, NumExtensions: 0, NumServices: 2, }, diff --git a/internal/proto/authd/authd.proto b/internal/proto/authd/authd.proto index 531a7153ef..e4fcb15654 100644 --- a/internal/proto/authd/authd.proto +++ b/internal/proto/authd/authd.proto @@ -16,7 +16,6 @@ service PAM { rpc IsAuthenticated(IARequest) returns (IAResponse); rpc EndSession(ESRequest) returns (Empty); - rpc SetBroker(STBRequest) returns (Empty); } message GBRequest { @@ -120,10 +119,6 @@ message IAResponse { string msg = 2; } -message STBRequest { - string broker_id = 1; - string username = 2; -} message ESRequest { string session_id = 1; diff --git a/internal/proto/authd/authd_grpc.pb.go b/internal/proto/authd/authd_grpc.pb.go index ca7b3860f9..675a723595 100644 --- a/internal/proto/authd/authd_grpc.pb.go +++ b/internal/proto/authd/authd_grpc.pb.go @@ -1,7 +1,7 @@ // Code generated by protoc-gen-go-grpc. DO NOT EDIT. // versions: -// - protoc-gen-go-grpc v1.6.2 -// - protoc v3.21.12 +// - protoc-gen-go-grpc v1.6.0 +// - protoc v6.33.1 // source: authd.proto package authd @@ -26,7 +26,6 @@ const ( PAM_SelectAuthenticationMode_FullMethodName = "/authd.PAM/SelectAuthenticationMode" PAM_IsAuthenticated_FullMethodName = "/authd.PAM/IsAuthenticated" PAM_EndSession_FullMethodName = "/authd.PAM/EndSession" - PAM_SetBroker_FullMethodName = "/authd.PAM/SetBroker" ) // PAMClient is the client API for PAM service. @@ -40,7 +39,6 @@ type PAMClient interface { SelectAuthenticationMode(ctx context.Context, in *SAMRequest, opts ...grpc.CallOption) (*SAMResponse, error) IsAuthenticated(ctx context.Context, in *IARequest, opts ...grpc.CallOption) (*IAResponse, error) EndSession(ctx context.Context, in *ESRequest, opts ...grpc.CallOption) (*Empty, error) - SetBroker(ctx context.Context, in *STBRequest, opts ...grpc.CallOption) (*Empty, error) } type pAMClient struct { @@ -121,16 +119,6 @@ func (c *pAMClient) EndSession(ctx context.Context, in *ESRequest, opts ...grpc. return out, nil } -func (c *pAMClient) SetBroker(ctx context.Context, in *STBRequest, opts ...grpc.CallOption) (*Empty, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(Empty) - err := c.cc.Invoke(ctx, PAM_SetBroker_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - // PAMServer is the server API for PAM service. // All implementations must embed UnimplementedPAMServer // for forward compatibility. @@ -142,7 +130,6 @@ type PAMServer interface { SelectAuthenticationMode(context.Context, *SAMRequest) (*SAMResponse, error) IsAuthenticated(context.Context, *IARequest) (*IAResponse, error) EndSession(context.Context, *ESRequest) (*Empty, error) - SetBroker(context.Context, *STBRequest) (*Empty, error) mustEmbedUnimplementedPAMServer() } @@ -174,9 +161,6 @@ func (UnimplementedPAMServer) IsAuthenticated(context.Context, *IARequest) (*IAR func (UnimplementedPAMServer) EndSession(context.Context, *ESRequest) (*Empty, error) { return nil, status.Error(codes.Unimplemented, "method EndSession not implemented") } -func (UnimplementedPAMServer) SetBroker(context.Context, *STBRequest) (*Empty, error) { - return nil, status.Error(codes.Unimplemented, "method SetBroker not implemented") -} func (UnimplementedPAMServer) mustEmbedUnimplementedPAMServer() {} func (UnimplementedPAMServer) testEmbeddedByValue() {} @@ -324,24 +308,6 @@ func _PAM_EndSession_Handler(srv interface{}, ctx context.Context, dec func(inte return interceptor(ctx, in, info, handler) } -func _PAM_SetBroker_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(STBRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(PAMServer).SetBroker(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: PAM_SetBroker_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(PAMServer).SetBroker(ctx, req.(*STBRequest)) - } - return interceptor(ctx, in, info, handler) -} - // PAM_ServiceDesc is the grpc.ServiceDesc for PAM service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) @@ -377,10 +343,6 @@ var PAM_ServiceDesc = grpc.ServiceDesc{ MethodName: "EndSession", Handler: _PAM_EndSession_Handler, }, - { - MethodName: "SetBroker", - Handler: _PAM_SetBroker_Handler, - }, }, Streams: []grpc.StreamDesc{}, Metadata: "authd.proto", diff --git a/internal/services/manager.go b/internal/services/manager.go index 1c28c3e031..5090a0e3ba 100644 --- a/internal/services/manager.go +++ b/internal/services/manager.go @@ -27,7 +27,7 @@ type Manager struct { } // NewManager returns a new manager after creating all necessary items for our business logic. -func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBrokers []string, usersConfig users.Config) (m Manager, err error) { +func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBrokers []string, usersConfig users.Config, pamConfig pam.Config) (m Manager, err error) { log.Debug(ctx, "Building authd object") brokerManager, err := brokers.NewManager(ctx, brokersConfPath, configuredBrokers) @@ -43,7 +43,7 @@ func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBr permissionManager := permissions.New() userService := user.NewService(ctx, userManager, brokerManager, &permissionManager) - pamService := pam.NewService(ctx, userManager, brokerManager, &permissionManager) + pamService := pam.NewService(ctx, userManager, brokerManager, pamConfig) return Manager{ userManager: userManager, @@ -57,7 +57,7 @@ func NewManager(ctx context.Context, dbDir, brokersConfPath string, configuredBr func (m Manager) RegisterGRPCServices(ctx context.Context) *grpc.Server { log.Debug(ctx, "Registering gRPC services") - opts := []grpc.ServerOption{permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(m.globalPermissions, errmessages.RedactErrorInterceptor)} + opts := []grpc.ServerOption{permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)} grpcServer := grpc.NewServer(opts...) healthCheck := health.NewServer() diff --git a/internal/services/manager_test.go b/internal/services/manager_test.go index 01fd3f59e7..4552e39e82 100644 --- a/internal/services/manager_test.go +++ b/internal/services/manager_test.go @@ -13,6 +13,7 @@ import ( "github.com/canonical/authd/internal/proto/authd" "github.com/canonical/authd/internal/services" "github.com/canonical/authd/internal/services/errmessages" + "github.com/canonical/authd/internal/services/pam" "github.com/canonical/authd/internal/testutils" "github.com/canonical/authd/internal/testutils/golden" "github.com/canonical/authd/internal/users" @@ -43,7 +44,7 @@ func TestNewManager(t *testing.T) { t.Setenv("DBUS_SYSTEM_BUS_ADDRESS", tc.systemBusSocket) } - m, err := services.NewManager(context.Background(), tc.dbDir, t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), tc.dbDir, t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) if tc.wantErr { require.Error(t, err, "NewManager should have returned an error, but did not") return @@ -58,7 +59,7 @@ func TestNewManager(t *testing.T) { func TestRegisterGRPCServices(t *testing.T) { t.Parallel() - m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) require.NoError(t, err, "Setup: could not create manager for the test") defer require.NoError(t, m.Stop(), "Teardown: Stop should not have returned an error, but did") @@ -75,7 +76,7 @@ func TestRegisterGRPCServices(t *testing.T) { func TestAccessAuthorization(t *testing.T) { t.Parallel() - m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig) + m, err := services.NewManager(context.Background(), t.TempDir(), t.TempDir(), nil, users.DefaultConfig, pam.DefaultConfig) require.NoError(t, err, "Setup: could not create manager for the test") defer require.NoError(t, m.Stop(), "Teardown: Stop should not have returned an error, but did") @@ -100,10 +101,10 @@ func TestAccessAuthorization(t *testing.T) { conn, err := grpc.NewClient("unix://"+socketPath, grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithUnaryInterceptor(errmessages.FormatErrorMessage)) require.NoError(t, err, "Setup: could not dial the server") - // Global authorization for PAM is always denied for non root user. + // PAM calls are allowed for non-root users. pamClient := authd.NewPAMClient(conn) _, err = pamClient.AvailableBrokers(context.Background(), &authd.Empty{}) - require.Error(t, err, "PAM calls are not allowed to any random user") + require.NoError(t, err, "PAM calls should be allowed for non-root users") // Global authorization for the user service is always granted for non root user. userServiceClient := authd.NewUserServiceClient(conn) diff --git a/internal/services/pam/auth_fail_tracker_test.go b/internal/services/pam/auth_fail_tracker_test.go new file mode 100644 index 0000000000..2d9e6758bf --- /dev/null +++ b/internal/services/pam/auth_fail_tracker_test.go @@ -0,0 +1,42 @@ +package pam + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" +) + +func TestAuthFailTracker_ResetWindow_Zero_DisablesReset(t *testing.T) { + t.Parallel() + + tracker := newAuthFailTracker(Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: time.Second, + AuthFailResetWindow: 0, + }) + + // Three consecutive failures should each increment the counter rather than + // resetting it. With the bug (resetWindow == 0 always resets), count would + // stay at 1 on every call. + require.Equal(t, 1, tracker.recordFailure("user"), "first failure") + require.Equal(t, 2, tracker.recordFailure("user"), "second failure") + require.Equal(t, 3, tracker.recordFailure("user"), "third failure: counter must not have been reset") +} + +func TestAuthFailTracker_ResetWindow_NonZero_ResetsAfterInactivity(t *testing.T) { + t.Parallel() + + tracker := newAuthFailTracker(Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: time.Second, + AuthFailResetWindow: 50 * time.Millisecond, + }) + + require.Equal(t, 1, tracker.recordFailure("user"), "first failure") + require.Equal(t, 2, tracker.recordFailure("user"), "second failure") + + // After sleeping past the reset window the entry expires and the counter resets. + time.Sleep(100 * time.Millisecond) + require.Equal(t, 1, tracker.recordFailure("user"), "counter should reset after inactivity") +} diff --git a/internal/services/pam/export_test.go b/internal/services/pam/export_test.go new file mode 100644 index 0000000000..e6202f4b35 --- /dev/null +++ b/internal/services/pam/export_test.go @@ -0,0 +1,10 @@ +package pam + +// Re-export DefaultConfig fields for use in tests. +var ( + AuthFailDelayThreshold = DefaultConfig.AuthFailDelayThreshold + AuthFailDelay = DefaultConfig.AuthFailDelay + + // AuthFailMaxTracked allows tests to override the tracker capacity. + AuthFailMaxTracked = &authFailMaxTracked +) diff --git a/internal/services/pam/pam.go b/internal/services/pam/pam.go index 8127df2dff..e926f6c664 100644 --- a/internal/services/pam/pam.go +++ b/internal/services/pam/pam.go @@ -6,15 +6,17 @@ import ( "encoding/json" "errors" "fmt" + "math" "os/user" "strings" + "sync" + "time" "github.com/canonical/authd/internal/brokers" "github.com/canonical/authd/internal/brokers/auth" "github.com/canonical/authd/internal/brokers/layouts" "github.com/canonical/authd/internal/decorate" "github.com/canonical/authd/internal/proto/authd" - "github.com/canonical/authd/internal/services/permissions" "github.com/canonical/authd/internal/users" "github.com/canonical/authd/internal/users/types" "github.com/canonical/authd/log" @@ -25,23 +27,105 @@ import ( var _ authd.PAMServer = Service{} +// authFailMaxTracked is the maximum number of distinct usernames tracked simultaneously +// to bound memory usage. +var authFailMaxTracked = 10000 + +// Config holds the configurable parameters for the PAM service. +type Config struct { + // AuthFailDelayThreshold is the number of consecutive authentication failures before + // a delay is imposed on subsequent attempts, to mitigate brute-force attacks. + AuthFailDelayThreshold int `mapstructure:"auth_fail_delay_threshold" yaml:"auth_fail_delay_threshold"` + // AuthFailDelay is the delay imposed after AuthFailDelayThreshold consecutive failures. + AuthFailDelay time.Duration `mapstructure:"auth_fail_delay" yaml:"auth_fail_delay"` + // AuthFailResetWindow is the duration after the last failure before the failure count + // is automatically reset, to avoid penalizing users indefinitely. + AuthFailResetWindow time.Duration `mapstructure:"auth_fail_reset_window" yaml:"auth_fail_reset_window"` +} + +// DefaultConfig is the default configuration for the PAM service. +var DefaultConfig = Config{ + AuthFailDelayThreshold: 3, + AuthFailDelay: 2 * time.Second, + AuthFailResetWindow: 15 * time.Minute, +} + +// authFailEntry holds the failure count and the time of the most recent failure for one user. +type authFailEntry struct { + count int + lastFail time.Time +} + +// authFailTracker counts consecutive per-user authentication failures and imposes +// a delay once the threshold is reached. +type authFailTracker struct { + mu sync.Mutex + entries map[string]*authFailEntry + resetWindow time.Duration +} + +func newAuthFailTracker(cfg Config) *authFailTracker { + return &authFailTracker{ + entries: make(map[string]*authFailEntry), + resetWindow: cfg.AuthFailResetWindow, + } +} + +// recordFailure increments the failure count for username and returns the new count. +// If the previous failure is older than resetWindow the counter is reset first. +// A resetWindow of 0 keeps failures accumulated indefinitely (no inactivity reset). +// When the tracker is at capacity the username is not stored, but math.MaxInt is +// returned so that the delay is still applied (fail-secure). +func (t *authFailTracker) recordFailure(username string) int { + t.mu.Lock() + defer t.mu.Unlock() + e, ok := t.entries[username] + if ok && t.resetWindow > 0 && time.Since(e.lastFail) >= t.resetWindow { + // Stale entry: treat as fresh start. + ok = false + } + if !ok { + if len(t.entries) >= authFailMaxTracked { + // At capacity: return a count that always exceeds the threshold so + // the delay is applied. This prevents a fill attack (flooding the + // tracker with bogus usernames) from disabling brute-force protection + // for the real target. + return math.MaxInt + } + e = &authFailEntry{} + t.entries[username] = e + } + e.count++ + e.lastFail = time.Now() + return e.count +} + +// recordSuccess resets the failure count for username. +func (t *authFailTracker) recordSuccess(username string) { + t.mu.Lock() + defer t.mu.Unlock() + delete(t.entries, username) +} + // Service is the implementation of the PAM module service. type Service struct { - userManager *users.Manager - brokerManager *brokers.Manager - permissionManager *permissions.Manager + userManager *users.Manager + brokerManager *brokers.Manager + failedAuths *authFailTracker + authFailConfig Config authd.UnimplementedPAMServer } // NewService returns a new PAM GRPC service. -func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager, permissionManager *permissions.Manager) Service { +func NewService(ctx context.Context, userManager *users.Manager, brokerManager *brokers.Manager, cfg Config) Service { log.Debug(ctx, "Building new gRPC PAM service") return Service{ - userManager: userManager, - brokerManager: brokerManager, - permissionManager: permissionManager, + userManager: userManager, + brokerManager: brokerManager, + failedAuths: newAuthFailTracker(cfg), + authFailConfig: cfg, } } @@ -293,7 +377,20 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res log.Debugf(ctx, "%s: Authentication result: %s", sessionID, access) + username := s.brokerManager.UsernameFromSessionID(sessionID) + if access != auth.Granted { + if access == auth.Denied || access == auth.DeniedMaxTries || access == auth.Retry { + if count := s.failedAuths.recordFailure(username); count > s.authFailConfig.AuthFailDelayThreshold { + log.Debugf(ctx, "%s: Delaying response after %d consecutive authentication failures for %q", sessionID, count, username) + timer := time.NewTimer(s.authFailConfig.AuthFailDelay) + select { + case <-timer.C: + case <-ctx.Done(): + timer.Stop() + } + } + } return &authd.IAResponse{ Access: access, Msg: data, @@ -357,45 +454,27 @@ func (s Service) IsAuthenticated(ctx context.Context, req *authd.IARequest) (res } } + // Set the broker as the default for the user on each successful authentication, + // unless it's the local broker (which is selected based on NSS resolution, not stored). + if broker.ID != brokers.LocalBrokerName { + if err = s.brokerManager.SetBroker(broker.ID, uInfo.Name); err != nil { + log.Errorf(ctx, "IsAuthenticated: Could not set default broker %q for user %q: %v", broker.ID, uInfo.Name, err) + return nil, err + } + if err = s.userManager.UpdateBrokerForUser(uInfo.Name, broker.ID); err != nil { + log.Errorf(ctx, "IsAuthenticated: Could not update broker for user %q in database: %v", uInfo.Name, err) + return nil, err + } + } + + s.failedAuths.recordSuccess(username) + return &authd.IAResponse{ Access: access, Msg: msg, }, nil } -// SetBroker sets the default broker for the given user. -func (s Service) SetBroker(ctx context.Context, req *authd.STBRequest) (empty *authd.Empty, err error) { - defer decorate.OnError(&err, "can't set default broker %q for user %q", req.GetBrokerId(), req.GetUsername()) - - // authd usernames are lowercase - username := strings.ToLower(req.GetUsername()) - brokerID := req.GetBrokerId() - - if username == "" { - log.Errorf(ctx, "SetBroker: No user name given") - return nil, status.Error(codes.InvalidArgument, "no user name given") - } - - // Don't allow setting the default broker to the local broker, because the decision to use the local broker should - // be made each time the user tries to log in, based on whether the user is provided by any other NSS service. - if brokerID == brokers.LocalBrokerName { - log.Errorf(ctx, "SetBroker: Can't set local broker as default for user %q", username) - return nil, status.Error(codes.InvalidArgument, "can't set local broker as default") - } - - if err = s.brokerManager.SetBroker(brokerID, username); err != nil { - log.Errorf(ctx, "SetBroker: Could not set default broker %q for user %q: %v", brokerID, username, err) - return &authd.Empty{}, err - } - - if err = s.userManager.UpdateBrokerForUser(username, brokerID); err != nil { - log.Errorf(ctx, "SetBroker: Could not update broker for user %q in database: %v", username, err) - return &authd.Empty{}, err - } - - return &authd.Empty{}, nil -} - // EndSession asks the broker associated with the sessionID to end the session. func (s Service) EndSession(ctx context.Context, req *authd.ESRequest) (empty *authd.Empty, err error) { defer decorate.OnError(&err, "could not abort session") diff --git a/internal/services/pam/pam_test.go b/internal/services/pam/pam_test.go index 29ba17cc63..fb56e1aff3 100644 --- a/internal/services/pam/pam_test.go +++ b/internal/services/pam/pam_test.go @@ -73,8 +73,7 @@ func TestNewService(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, t.TempDir()) require.NoError(t, err, "Setup: could not create user manager") - pm := permissions.New() - service := pam.NewService(context.Background(), m, globalBrokerManager, &pm) + service := pam.NewService(context.Background(), m, globalBrokerManager, pam.DefaultConfig) brokers, err := service.AvailableBrokers(context.Background(), &authd.Empty{}) require.NoError(t, err, "can’t create the service directly") @@ -85,20 +84,15 @@ func TestAvailableBrokers(t *testing.T) { t.Parallel() tests := map[string]struct { - currentUserNotRoot bool - wantErr bool }{ "Success_getting_available_brokers": {}, - - "Error_when_not_root": {currentUserNotRoot: true, wantErr: true}, } for name, tc := range tests { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) abResp, err := client.AvailableBrokers(context.Background(), &authd.Empty{}) @@ -128,8 +122,7 @@ func TestGetBroker(t *testing.T) { tests := map[string]struct { user string - currentUserNotRoot bool - onlyLocalBroker bool + onlyLocalBroker bool wantBroker string wantErr bool @@ -142,8 +135,6 @@ func TestGetBroker(t *testing.T) { "Returns_empty_when_user_does_not_exist": {user: "nonexistent@example.com", wantBroker: ""}, "Returns_empty_when_user_does_not_have_a_broker": {user: "userwithoutbroker@example.com", wantBroker: ""}, "Returns_empty_when_broker_is_not_available": {user: "userwithinactivebroker@example.com", wantBroker: ""}, - - "Error_when_not_root": {user: "userwithbroker@example.com", currentUserNotRoot: true, wantErr: true}, } for name, tc := range tests { t.Run(name, func(t *testing.T) { @@ -164,14 +155,13 @@ func TestGetBroker(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, dbDir) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) brokerManager := globalBrokerManager if tc.onlyLocalBroker { brokerManager, err = brokers.NewManager(context.Background(), "", nil) require.NoError(t, err, "Setup: could not create broker manager with only local broker") } - client := newPamClient(t, m, brokerManager, &pm) + client := newPamClient(t, m, brokerManager) // Get existing entry gotResp, err := client.GetBroker(context.Background(), &authd.GBRequest{Username: tc.user}) @@ -196,14 +186,11 @@ func TestSelectBroker(t *testing.T) { sessionMode string existingDB string - currentUserNotRoot bool - wantErr bool }{ "Successfully_select_a_broker_and_creates_auth_session": {username: "success@example.com", sessionMode: auth.SessionModeLogin}, "Successfully_select_a_broker_and_creates_passwd_session": {username: "success@example.com", sessionMode: auth.SessionModeChangePassword}, - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_username_is_empty": {wantErr: true}, "Error_when_mode_is_empty": {sessionMode: "-", wantErr: true}, "Error_when_mode_does_not_exist": {sessionMode: "does not exist", wantErr: true}, @@ -228,8 +215,7 @@ func TestSelectBroker(t *testing.T) { require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) switch tc.brokerID { case "": @@ -279,15 +265,13 @@ func TestGetAuthenticationModes(t *testing.T) { sessionID string supportedUILayouts []*authd.UILayout - username string - currentUserNotRoot bool + username string wantErr bool }{ "Successfully_get_authentication_modes": {}, "Successfully_get_multiple_authentication_modes": {username: "gam_multiple_modes@example.com"}, - "Error_when_not_root": {currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_passing_invalid_layout": {supportedUILayouts: []*authd.UILayout{emptyType}, wantErr: true}, "Error_when_sessionID_is_invalid": {sessionID: "invalid-session", wantErr: true}, @@ -298,8 +282,7 @@ func TestGetAuthenticationModes(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -312,9 +295,6 @@ func TestGetAuthenticationModes(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - if tc.supportedUILayouts == nil { tc.supportedUILayouts = []*authd.UILayout{requiredEntry} } @@ -346,7 +326,6 @@ func TestSelectAuthenticationMode(t *testing.T) { username string supportedUILayouts []*authd.UILayout noValidators bool - currentUserNotRoot bool wantErr bool }{ @@ -354,7 +333,6 @@ func TestSelectAuthenticationMode(t *testing.T) { "Successfully_select_mode_with_missing_optional_value": {username: "sam_missing_optional_entry@example.com", supportedUILayouts: []*authd.UILayout{optionalEntry}}, // service errors - "Error_when_not_root": {username: "sam_success_required_entry@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_session_ID_is_invalid": {sessionID: "invalid-session", wantErr: true}, "Error_when_no_authmode_is_selected": {sessionID: "no auth mode", authMode: "-", wantErr: true}, @@ -373,8 +351,7 @@ func TestSelectAuthenticationMode(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -405,9 +382,6 @@ func TestSelectAuthenticationMode(t *testing.T) { require.NoError(t, err, "Setup: failed to get authentication modes for tests") } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - samReq := &authd.SAMRequest{ SessionId: tc.sessionID, AuthenticationModeId: tc.authMode, @@ -430,11 +404,10 @@ func TestIsAuthenticated(t *testing.T) { sessionID string existingDB string - username string - secondCall bool - cancelFirstCall bool - localGroupsFile string - currentUserNotRoot bool + username string + secondCall bool + cancelFirstCall bool + localGroupsFile string // There is no wantErr as it's stored in the golden file. }{ @@ -449,7 +422,6 @@ func TestIsAuthenticated(t *testing.T) { "Successfully_authenticate_with_groups_with_uppercase": {username: "success_with_uppercase_groups@example.com"}, // service errors - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true}, "Error_when_sessionID_is_empty": {sessionID: "-"}, "Error_when_there_is_no_broker": {sessionID: "invalid-session"}, "Error_when_user_is_locked": {username: "locked@example.com", existingDB: "cache-with-locked-user.db"}, @@ -493,8 +465,7 @@ func TestIsAuthenticated(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, dbDir, managerOpts...) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -507,9 +478,6 @@ func TestIsAuthenticated(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - var firstCall, secondCall string ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -578,6 +546,105 @@ func TestIsAuthenticated(t *testing.T) { } } +func TestIsAuthenticated_FailDelay(t *testing.T) { + t.Parallel() + + client := newPamClient(t, nil, globalBrokerManager) + + sessionID := startSession(t, client, "ia_denied@example.com") + iaReq := &authd.IARequest{ + SessionId: sessionID, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + } + + // The first authFailDelayThreshold failures should not be delayed. + for i := range pam.AuthFailDelayThreshold { + start := time.Now() + _, err := client.IsAuthenticated(context.Background(), iaReq) + require.NoError(t, err, "IsAuthenticated should not return an error") + require.Less(t, time.Since(start), pam.AuthFailDelay, + "attempt %d of %d should not trigger the fail delay", i+1, pam.AuthFailDelayThreshold) + } + + // The next failure should be delayed. + start := time.Now() + _, err := client.IsAuthenticated(context.Background(), iaReq) + require.NoError(t, err, "IsAuthenticated should not return an error") + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "attempt after threshold should be delayed") +} + +// TestIsAuthenticated_FailDelay_Retry verifies that auth.Retry responses also +// count toward the failure-delay threshold. An attacker who uses a fresh +// session for every guess always receives auth.Retry (the per-session +// DeniedMaxTries counter never fires), so without this the delay would never +// trigger. +func TestIsAuthenticated_FailDelay_Retry(t *testing.T) { + t.Parallel() + + client := newPamClient(t, nil, globalBrokerManager) + + // Each call uses a fresh session, mimicking an attacker who resets the + // per-session retry counter by reconnecting. + makeRetryAttempt := func() { + t.Helper() + sessionID := startSession(t, client, "ia_retry@example.com") + _, err := client.IsAuthenticated(context.Background(), &authd.IARequest{ + SessionId: sessionID, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + }) + require.NoError(t, err, "IsAuthenticated should not return an error") + } + + // The first authFailDelayThreshold failures should not be delayed. + for i := range pam.AuthFailDelayThreshold { + start := time.Now() + makeRetryAttempt() + require.Less(t, time.Since(start), pam.AuthFailDelay, + "attempt %d of %d should not trigger the fail delay", i+1, pam.AuthFailDelayThreshold) + } + + // The next failure should be delayed even though it is in a new session. + start := time.Now() + makeRetryAttempt() + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "retry attempt after threshold should be delayed") +} + +func TestIsAuthenticated_FailDelayTrackerFull(t *testing.T) { + // Cannot be parallel: temporarily overrides the package-level authFailMaxTracked. + //nolint:paralleltest // modifies package-level authFailMaxTracked, cannot run in parallel + + // Use a tracker that can only hold a single entry so we can fill it with + // one bogus username and then verify the delay is still applied to a + // second, previously unseen username (fail-secure behaviour). + orig := *pam.AuthFailMaxTracked + *pam.AuthFailMaxTracked = 1 + t.Cleanup(func() { *pam.AuthFailMaxTracked = orig }) + + client := newPamClient(t, nil, globalBrokerManager) + + // Fill the tracker with a bogus username. + bogusSession := startSession(t, client, "ia_denied@example.com") + _, _ = client.IsAuthenticated(context.Background(), &authd.IARequest{ + SessionId: bogusSession, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + }) + + // A different user's first failure should still be delayed even though the + // tracker is full (fill-attack protection). + targetSession := startSession(t, client, "ia_denied_second@example.com") + iaReq := &authd.IARequest{ + SessionId: targetSession, + AuthenticationData: &authd.IARequest_AuthenticationData{}, + } + + start := time.Now() + _, _ = client.IsAuthenticated(context.Background(), iaReq) + require.GreaterOrEqual(t, time.Since(start), pam.AuthFailDelay, + "first failure for new user should be delayed when tracker is full") +} + func TestIDGeneration(t *testing.T) { t.Parallel() usernamePrefix := t.Name() @@ -601,8 +668,7 @@ func TestIDGeneration(t *testing.T) { m, err := users.NewManager(users.DefaultConfig, t.TempDir(), managerOpts...) require.NoError(t, err, "Setup: could not create user manager") t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, m, globalBrokerManager, &pm) + client := newPamClient(t, m, globalBrokerManager) sbResp, err := client.SelectBroker(context.Background(), &authd.SBRequest{ BrokerId: mockBrokerGeneratedID, @@ -622,81 +688,18 @@ func TestIDGeneration(t *testing.T) { } } -func TestSetBroker(t *testing.T) { - t.Parallel() - - tests := map[string]struct { - username string - brokerID string - currentUserNotRoot bool - - wantErr bool - }{ - "Set_broker_for_existing_user_with_no_broker": {username: "usersetbroker@example.com"}, - "Update_broker_for_existing_user_with_a_broker": {username: "userupdatebroker@example.com"}, - "Username_is_case_insensitive": {username: "UserSetBroker@example.com"}, - - "Error_when_setting_broker_to_local_broker": {username: "userlocalbroker@example.com", brokerID: brokers.LocalBrokerName, wantErr: true}, - "Error_when_not_root": {username: "usersetbroker@example.com", currentUserNotRoot: true, wantErr: true}, - "Error_when_username_is_empty": {wantErr: true}, - "Error_when_user_does_not_exist_": {username: "doesnotexist@example.com", wantErr: true}, - "Error_when_broker_does_not_exist": {username: "userwithbroker@example.com", brokerID: "does not exist", wantErr: true}, - } - for name, tc := range tests { - t.Run(name, func(t *testing.T) { - t.Parallel() - - dbDir := t.TempDir() - err := db.Z_ForTests_CreateDBFromYAML(filepath.Join(testutils.TestFamilyPath(t), "set-broker.db"), dbDir) - require.NoError(t, err, "Setup: could not create database from testdata") - - m, err := users.NewManager(users.DefaultConfig, dbDir) - require.NoError(t, err, "Setup: could not create user manager") - t.Cleanup(func() { _ = m.Stop() }) - pm := newPermissionManager(t, tc.currentUserNotRoot) - client := newPamClient(t, m, globalBrokerManager, &pm) - - if tc.brokerID == "" { - tc.brokerID = mockBrokerGeneratedID - } - - stbReq := &authd.STBRequest{ - BrokerId: tc.brokerID, - Username: tc.username, - } - _, err = client.SetBroker(context.Background(), stbReq) - if tc.wantErr { - require.Error(t, err, "SetBroker should return an error, but did not") - return - } - require.NoError(t, err, "SetBroker should not return an error, but did") - - gbResp, err := client.GetBroker(context.Background(), &authd.GBRequest{Username: tc.username}) - require.NoError(t, err, "GetBroker should not return an error") - require.Equal(t, tc.brokerID, gbResp.GetBroker(), "SetBroker should set the default broker as expected") - - // Check that database has been updated too. - gotDB, err := db.Z_ForTests_DumpNormalizedYAML(userstestutils.DBManager(m)) - require.NoError(t, err, "Setup: failed to dump database for comparing") - golden.CheckOrUpdate(t, gotDB, golden.WithPath("cache.db")) - }) - } -} - func TestEndSession(t *testing.T) { t.Parallel() tests := map[string]struct { sessionID string - username string - currentUserNotRoot bool + username string wantErr bool }{ "Successfully_end_session": {username: "success@example.com"}, - "Error_when_not_root": {username: "success@example.com", currentUserNotRoot: true, wantErr: true}, "Error_when_sessionID_is_empty": {sessionID: "-", wantErr: true}, "Error_when_sessionID_is_invalid": {sessionID: "invalid-session", wantErr: true}, "Error_when_ending_session": {username: "es_error@example.com", wantErr: true}, @@ -705,8 +708,7 @@ func TestEndSession(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - pm := newPermissionManager(t, false) // Allow starting the session (current user considered root) - client := newPamClient(t, nil, globalBrokerManager, &pm) + client := newPamClient(t, nil, globalBrokerManager) switch tc.sessionID { case "invalid-session": @@ -719,9 +721,6 @@ func TestEndSession(t *testing.T) { } } - // Now, set tests permissions for this use case - permissions.Z_ForTests_SetCurrentUserAsRoot(&pm, !tc.currentUserNotRoot) - esReq := &authd.ESRequest{ SessionId: tc.sessionID, } @@ -759,10 +758,9 @@ func initBrokers() (brokerConfigPath string, cleanup func(), err error) { }, nil } -// newPAMClient returns a new GRPC PAM client for tests connected to brokerManager with the given database and -// permissionmanager. +// newPAMClient returns a new GRPC PAM client for tests connected to brokerManager with the given database. // If the one passed is nil, this function will create the database and close it upon test teardown. -func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager, pm *permissions.Manager) (client authd.PAMClient) { +func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager) (client authd.PAMClient) { t.Helper() // socket path is limited in length. @@ -780,9 +778,9 @@ func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager t.Cleanup(func() { _ = m.Stop() }) } - service := pam.NewService(context.Background(), m, brokerManager, pm) + service := pam.NewService(context.Background(), m, brokerManager, pam.DefaultConfig) - grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(enableCheckGlobalAccess(service), errmessages.RedactErrorInterceptor)) + grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)) authd.RegisterPAMServer(grpcServer, service) done := make(chan struct{}) go func() { @@ -802,29 +800,6 @@ func newPamClient(t *testing.T, m *users.Manager, brokerManager *brokers.Manager return authd.NewPAMClient(conn) } -// newPermissionManager factors out permission manager creation for tests. -// this permission manager can then be tweaked for mimicking currentUser considered as root not. -func newPermissionManager(t *testing.T, currentUserNotRoot bool) permissions.Manager { - t.Helper() - - var opts = []permissions.Option{} - if !currentUserNotRoot { - opts = append(opts, permissions.Z_ForTests_WithCurrentUserAsRoot()) - } - return permissions.New(opts...) -} - -// enableCheckGlobalAccess returns the middleware hooking up in CheckGlobalAccess for the given service. -func enableCheckGlobalAccess(s pam.Service) grpc.UnaryServerInterceptor { - return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if err := s.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, err - } - - return handler(ctx, req) - } -} - // getMockBrokerGeneratedID returns the generated ID for the mock broker. func getMockBrokerGeneratedID(brokerManager *brokers.Manager) (string, error) { for _, b := range brokerManager.AvailableBrokers() { diff --git a/internal/services/pam/permissions.go b/internal/services/pam/permissions.go deleted file mode 100644 index 47d4347b7a..0000000000 --- a/internal/services/pam/permissions.go +++ /dev/null @@ -1,8 +0,0 @@ -package pam - -import "context" - -// CheckGlobalAccess denies all requests not coming from the root user. -func (s Service) CheckGlobalAccess(ctx context.Context, method string) error { - return s.permissionManager.CheckRequestIsFromRoot(ctx) -} diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated deleted file mode 100644 index 827eb715d3..0000000000 --- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/IsAuthenticated +++ /dev/null @@ -1,4 +0,0 @@ -FIRST CALL: - access: - msg: - err: only root can perform this operation diff --git a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db b/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db deleted file mode 100644 index 0cbb6c1eee..0000000000 --- a/internal/services/pam/testdata/golden/TestIsAuthenticated/Error_when_not_root/cache.db +++ /dev/null @@ -1,4 +0,0 @@ -users: [] -groups: [] -users_to_groups: [] -schema_version: 3 diff --git a/internal/services/permissions.go b/internal/services/permissions.go deleted file mode 100644 index 1c43c232e5..0000000000 --- a/internal/services/permissions.go +++ /dev/null @@ -1,24 +0,0 @@ -package services - -import ( - "context" - "strings" - - "google.golang.org/grpc" - "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" -) - -func (m Manager) globalPermissions(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if strings.HasPrefix(info.FullMethod, "/authd.PAM/") { - if err := m.pamService.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, status.Error(codes.PermissionDenied, err.Error()) - } - } else if strings.HasPrefix(info.FullMethod, "/authd.NSS/") { - if err := m.userService.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, status.Error(codes.PermissionDenied, err.Error()) - } - } - - return handler(ctx, req) -} diff --git a/internal/services/permissions/testutils.go b/internal/services/permissions/testutils.go index 742d5505ec..340243f58a 100644 --- a/internal/services/permissions/testutils.go +++ b/internal/services/permissions/testutils.go @@ -40,20 +40,6 @@ func currentUserUID() uint32 { return uint32(uid) } -// Z_ForTests_SetCurrentUserAsRoot mutates a default permission to the current user's UID if currentUserAsRoot is true. -// -// nolint:revive,nolintlint // We want to use underscores in the function name here. -func Z_ForTests_SetCurrentUserAsRoot(m *Manager, currentUserAsRoot bool) { - testsdetection.MustBeTesting() - - if !currentUserAsRoot { - m.rootUID = defaultOptions.rootUID - return - } - - m.rootUID = currentUserUID() -} - // Z_ForTests_IdempotentPermissionError strips the UID from gRPC peer credential // messages (format: "uid: , pid: ") to make test output deterministic // regardless of which user runs the tests. diff --git a/internal/services/testdata/golden/TestRegisterGRPCServices b/internal/services/testdata/golden/TestRegisterGRPCServices index 94c95fb443..12f1629588 100644 --- a/internal/services/testdata/golden/TestRegisterGRPCServices +++ b/internal/services/testdata/golden/TestRegisterGRPCServices @@ -21,9 +21,6 @@ authd.PAM: - name: SelectBroker isclientstream: false isserverstream: false - - name: SetBroker - isclientstream: false - isserverstream: false metadata: authd.proto authd.UserService: methods: diff --git a/internal/services/user/permissions.go b/internal/services/user/permissions.go deleted file mode 100644 index 5d04a9d341..0000000000 --- a/internal/services/user/permissions.go +++ /dev/null @@ -1,10 +0,0 @@ -package user - -import ( - "context" -) - -// CheckGlobalAccess always return access, then individual calls are filtered. -func (s Service) CheckGlobalAccess(ctx context.Context, method string) error { - return nil -} diff --git a/internal/services/user/user_test.go b/internal/services/user/user_test.go index 18667cce92..64b70dd950 100644 --- a/internal/services/user/user_test.go +++ b/internal/services/user/user_test.go @@ -620,7 +620,7 @@ func newUserServiceClient(t *testing.T, dbFile string, currentUserNotRoot ...boo } service := user.NewService(context.Background(), userManager, brokerManager, &permissionsManager) - grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(enableCheckGlobalAccess(service), errmessages.RedactErrorInterceptor)) + grpcServer := grpc.NewServer(permissions.WithUnixPeerCreds(), grpc.ChainUnaryInterceptor(errmessages.RedactErrorInterceptor)) authd.RegisterUserServiceServer(grpcServer, service) done := make(chan struct{}) go func() { @@ -640,16 +640,6 @@ func newUserServiceClient(t *testing.T, dbFile string, currentUserNotRoot ...boo return authd.NewUserServiceClient(conn), userManager } -func enableCheckGlobalAccess(s user.Service) grpc.UnaryServerInterceptor { - return func(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error) { - if err := s.CheckGlobalAccess(ctx, info.FullMethod); err != nil { - return nil, err - } - - return handler(ctx, req) - } -} - // newUserManagerForTests returns a user manager object cleaned up with the test ends. func newUserManagerForTests(t *testing.T, dbFile string) *users.Manager { t.Helper() diff --git a/internal/testutils/broker.go b/internal/testutils/broker.go index f542923df4..9adda46e31 100644 --- a/internal/testutils/broker.go +++ b/internal/testutils/broker.go @@ -302,6 +302,14 @@ func (b *BrokerBusMock) IsAuthenticated(sessionID, authenticationData string) (a access = authDenied data = "" + case "ia_denied", "ia_denied_second": + access = authDenied + data = `{"message": "access denied"}` + + case "ia_retry", "ia_retry_second": + access = authRetry + data = `{"message": "invalid credentials, please retry"}` + case "ia_retry_without_data": access = authRetry data = "" diff --git a/pam/integration-tests/cli_test.go b/pam/integration-tests/cli_test.go index 9b6baf5bf1..90bb7820e4 100644 --- a/pam/integration-tests/cli_test.go +++ b/pam/integration-tests/cli_test.go @@ -36,7 +36,6 @@ func TestCLIAuthenticate(t *testing.T) { username string // typed at the Username: prompt (empty = use pamUser as preset) clientOptions clientOptions - currentUserNotRoot bool wantLocalGroups bool expectedExitCode int extraArgs []string @@ -557,14 +556,6 @@ func TestCLIAuthenticate(t *testing.T) { }, }, - "Deny_authentication_if_current_user_is_not_considered_as_root": { - currentUserNotRoot: true, - expectedExitCode: 0, - test: func(t *testing.T, c *ptytest.Console) { - t.Helper() - cliWaitForResult(t, c) - }, - }, "Deny_authentication_if_max_attempts_reached": { username: "user-integration-max-attempts@example.com", expectedExitCode: 0, @@ -702,7 +693,7 @@ func TestCLIAuthenticate(t *testing.T) { var socketPath, groupFileOutput string var cancelAuthd func() - if tc.wantLocalGroups || tc.currentUserNotRoot || tc.useCancelableAuthd { + if tc.wantLocalGroups || tc.useCancelableAuthd { var groupFile string groupFileOutput, groupFile = prepareGroupFiles(t) @@ -713,9 +704,7 @@ func TestCLIAuthenticate(t *testing.T) { args := []testutils.DaemonOption{ testutils.WithGroupFile(groupFile), testutils.WithGroupFileOutput(groupFileOutput), - } - if !tc.currentUserNotRoot { - args = append(args, testutils.WithCurrentUserAsRoot) + testutils.WithCurrentUserAsRoot, } if tc.useCancelableAuthd { @@ -850,11 +839,18 @@ func cliChangePasswordWithRetry(t *testing.T, c *ptytest.Console, firstNew, firs cliSendPassword(t, c, secondNew) } -// cliWaitForResult waits for the complete PAM AcctMgmt() result block. +// cliWaitForResult waits for the complete PAM Authenticate() result block. func cliWaitForResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionAuthenticate) +} + +// cliWaitForChangeAuthTokResult waits for the complete PAM ChangeAuthTok() result block. +func cliWaitForChangeAuthTokResult(t *testing.T, c *ptytest.Console) { + t.Helper() + + waitForRunnerResult(t, c, pam_test.RunnerResultActionChangeAuthTok) } func cliAuthenticateWithQRCode(t *testing.T, c *ptytest.Console, signalFn func(string), username string) { @@ -905,8 +901,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliEnv := preparePamRunnerTest(t, clientPath) tests := map[string]struct { - username string - currentUserNotRoot bool + username string test func(t *testing.T, socketPath, username string) string }{ @@ -922,7 +917,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) c2 := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionLogin, cliEnv, clientOptions{}) @@ -953,7 +948,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) c2 := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionLogin, cliEnv, clientOptions{}) @@ -1001,7 +996,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1016,7 +1011,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c1, "goodpass") cliChangePasswordWithRetry(t, c1, "noble2404", "noble2404", `new password does not match criteria`, "authd2404") - cliWaitForResult(t, c1) + cliWaitForChangeAuthTokResult(t, c1) c1.RequireSuccessfulExit(t) // Repeat the flow to verify that after a rejection, the user can still change the password successfully. @@ -1029,7 +1024,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c2, "authd2404") cliChangePasswordWithRetry(t, c2, "noble2404", "noble2404", `new password does not match criteria`, "goodpass") - cliWaitForResult(t, c2) + cliWaitForChangeAuthTokResult(t, c2) c2.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c1) + ptySanitizeSnapshots(t, c2) @@ -1049,7 +1044,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1064,7 +1059,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "goodpass") cliChangePasswordWithRetry(t, c, "authd2404", "badpass", `Password entries don't match`, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1091,7 +1086,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSendPassword(t, c, "authd2404") c.WaitFor(t, `Confirm password`) cliSendPassword(t, c, "authd2404") - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1119,9 +1114,9 @@ func TestCLIChangeAuthTok(t *testing.T) { c.WaitFor(t, `Maximum number of authentication attempts reached`) // The snapshot at this point is flaky: sometimes the PAM result // has already been rendered alongside the error message, sometimes - // not. Discard it; cliWaitForResult captures the stable final state. + // not. Discard it; cliWaitForChangeAuthTokResult captures the stable final state. c.DiscardLastSnapshot() - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1133,17 +1128,7 @@ func TestCLIChangeAuthTok(t *testing.T) { c := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionPasswd, cliEnv, clientOptions{}) cliEnterUsername(t, c, username) cliSelectBroker(t, c) - cliWaitForResult(t, c) - c.RequireSuccessfulExit(t) - return ptySanitizeSnapshots(t, c) - }, - }, - "Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate": { - currentUserNotRoot: true, - test: func(t *testing.T, socketPath, username string) string { - t.Helper() - c := startCLIPAMRunner(t, clientPath, socketPath, pam_test.RunnerActionPasswd, cliEnv, clientOptions{}) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1156,7 +1141,7 @@ func TestCLIChangeAuthTok(t *testing.T) { c.WaitFor(t, `Select your provider`) c.WaitFor(t, `1\. local`) c.SendKey(t, ptytest.KeyEnter) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1169,7 +1154,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSelectBroker(t, c) c.WaitFor(t, `Gimme your password`) c.SendKey(t, ptytest.KeyCtrlC) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1182,7 +1167,7 @@ func TestCLIChangeAuthTok(t *testing.T) { cliSelectBroker(t, c) c.WaitFor(t, `Gimme your password`) c.SendKey(t, ptytest.KeyCtrlD) - cliWaitForResult(t, c) + cliWaitForChangeAuthTokResult(t, c) c.RequireSuccessfulExit(t) return ptySanitizeSnapshots(t, c) }, @@ -1197,19 +1182,14 @@ func TestCLIChangeAuthTok(t *testing.T) { if err := os.WriteFile(groupFile, nil, 0o600); err != nil { t.Fatalf("Setup: could not create group file: %v", err) } - var socketPath string - if tc.currentUserNotRoot { - socketPath = runAuthd(t, testutils.WithGroupFile(groupFile)) - } else { - socketPath = runAuthd(t, - testutils.WithCurrentUserAsRoot, - testutils.WithGroupFile(groupFile), - testutils.WithGroupFileOutput(groupFile), - ) - } + socketPath := runAuthd(t, + testutils.WithCurrentUserAsRoot, + testutils.WithGroupFile(groupFile), + testutils.WithGroupFileOutput(groupFile), + ) username := tc.username - if username == "" && !tc.currentUserNotRoot { + if username == "" { username = testUserName(t, "cli-passwd") } @@ -1260,7 +1240,4 @@ func TestPamCLIRunStandalone(t *testing.T) { if !strings.Contains(outStr, pam.ErrAuthinfoUnavail.Error()) { t.Errorf("Expected output to contain %s", pam.ErrAuthinfoUnavail.Error()) } - if !strings.Contains(outStr, pam.ErrIgnore.Error()) { - t.Errorf("Expected output to contain %s", pam.ErrIgnore.Error()) - } } diff --git a/pam/integration-tests/gdm_test.go b/pam/integration-tests/gdm_test.go index 391e397078..d1d1331447 100644 --- a/pam/integration-tests/gdm_test.go +++ b/pam/integration-tests/gdm_test.go @@ -165,7 +165,6 @@ func TestGdmModule(t *testing.T) { wantAuthResponses []*authd.IAResponse wantPamInfoMessages []string wantPamErrorMessages []string - wantAcctMgmtErr error }{ "Authenticates_user": { eventPollResponses: map[gdm.EventType][]*gdm.EventData{ @@ -778,16 +777,14 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "GDM protocol initialization failed, type hello, version 9999", }, - wantError: pam.ErrCredUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrCredUnavail, }, "Error_on_connection_failure": { moduleArgs: []string{"socket=/some-path/not-existent-socket"}, wantPamErrorMessages: []string{ "could not connect to unix:///some-path/not-existent-socket: service took too long to respond. Disconnecting client", }, - wantError: pam.ErrAuthinfoUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuthinfoUnavail, }, "Error_on_missing_user": { pamUser: ptrValue(""), @@ -799,32 +796,28 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "error InvalidArgument from server: no user name provided", }, - wantError: pam.ErrSystem, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrSystem, }, "Error_on_no_supported_layouts": { supportedLayouts: []*authd.UILayout{}, wantPamErrorMessages: []string{ "UI does not support any layouts", }, - wantError: pam.ErrCredUnavail, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrCredUnavail, }, "Error_on_unknown_broker": { brokerName: "Not a valid broker!", wantPamErrorMessages: []string{ "Changing GDM stage failed: Conversation error", }, - wantError: pam.ErrSystem, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrSystem, }, "Error_(ignored)_on_local_broker_causes_fallback_error": { brokerName: brokers.LocalBrokerName, wantPamInfoMessages: []string{ "auth=incomplete", }, - wantError: pam_test.ErrIgnore, - wantAcctMgmtErr: pam.ErrAbort, + wantError: pam_test.ErrIgnore, }, "Error_on_authenticating_user_with_too_many_retries": { wantAuthModeIDs: []string{ @@ -881,8 +874,7 @@ func TestGdmModule(t *testing.T) { wantPamErrorMessages: []string{ "Maximum number of authentication attempts reached", }, - wantError: pam.ErrMaxtries, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrMaxtries, }, "Error_on_authenticating_unknown_user": { pamUser: ptrValue("user-unknown"), @@ -903,8 +895,7 @@ func TestGdmModule(t *testing.T) { Msg: "user not found", }, }, - wantError: pam.ErrAuth, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuth, }, "Error_on_invalid_fido_ack": { pamUserPrefix: examplebroker.UserIntegrationMfaPrefix, @@ -931,8 +922,7 @@ func TestGdmModule(t *testing.T) { Msg: fido1AuthID + " should have wait set to true", }, }, - wantError: pam.ErrAuth, - wantAcctMgmtErr: pam_test.ErrIgnore, + wantError: pam.ErrAuth, }, } for name, tc := range testCases { @@ -1105,9 +1095,6 @@ func TestGdmModule(t *testing.T) { } requirePreviousBrokerForUser(t, socketPath, brokerAfterAuth, pamUser) - require.ErrorIs(t, gh.tx.AcctMgmt(pamFlags), tc.wantAcctMgmtErr, - "Account Management PAM Error messages do not match") - require.Empty(t, gh.selectedAuthModeIDs, "Some Authentication Modes IDs have not been selected") require.Empty(t, gh.selectedUILayouts, @@ -1207,9 +1194,6 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) { pamFlags = pam.Silent } - require.NoError(t, gh.tx.Authenticate(pamFlags), "Setup: Authentication failed") - requirePreviousBrokerForUser(t, socketPath, gh.selectedBrokerName, pamUser) - // We disable gdm extension support, as if it was the case when the module is loaded // again from the exec module. gdm.AdvertisePamExtensions(nil) @@ -1217,7 +1201,6 @@ func TestGdmModuleAcctMgmtWithoutGdmExtension(t *testing.T) { require.ErrorIs(t, gh.tx.AcctMgmt(pamFlags), pam_test.ErrIgnore, "Account Management PAM Error message do not match") - requirePreviousBrokerForUser(t, socketPath, gh.selectedBrokerName, pamUser) } func buildPAMModule(t *testing.T) string { diff --git a/pam/integration-tests/helpers_test.go b/pam/integration-tests/helpers_test.go index 575795dbf1..864da7f2a4 100644 --- a/pam/integration-tests/helpers_test.go +++ b/pam/integration-tests/helpers_test.go @@ -558,9 +558,6 @@ func requireRunnerResultForUser(t *testing.T, sessionMode authd.SessionMode, use require.Contains(t, goldenContent, pam_test.RunnerAction(sessionMode).Result().Message(user), "Golden file does not include required value, consider increasing the terminal size:\n%s", goldenContent) - require.Contains(t, goldenContent, pam_test.RunnerResultActionAcctMgmt.Message(user), - "Golden file does not include required value, consider increasing the terminal size:\n%s", - goldenContent) } // requireRunnerResult checks that the golden content contains the expected diff --git a/pam/integration-tests/native_test.go b/pam/integration-tests/native_test.go index e912ce6202..0329a2afdf 100644 --- a/pam/integration-tests/native_test.go +++ b/pam/integration-tests/native_test.go @@ -2,7 +2,6 @@ package main_test import ( "fmt" - "path/filepath" "regexp" "strings" "testing" @@ -86,7 +85,6 @@ func TestNativeAuthenticate(t *testing.T) { username string clientOptions clientOptions - currentUserNotRoot bool wantLocalGroups bool wantSeparateDaemon bool skipRunnerCheck bool @@ -540,11 +538,6 @@ func TestNativeAuthenticate(t *testing.T) { test: func(t *testing.T, c *ptytest.Console) { t.Helper(); nativeWaitForResult(t, c) }, expectedUser: "root", }, - "Deny_authentication_if_current_user_is_not_considered_as_root": { - currentUserNotRoot: true, - test: func(t *testing.T, c *ptytest.Console) { t.Helper(); nativeWaitForResult(t, c) }, - expectedUser: testUserName(t, "native"), - }, "Deny_authentication_if_max_attempts_reached": { test: func(t *testing.T, c *ptytest.Console) { t.Helper() @@ -698,20 +691,17 @@ func TestNativeAuthenticate(t *testing.T) { testutils.WithGroupFileOutput(groupFileOutput), ) t.Cleanup(authdCancel) - case tc.wantLocalGroups || tc.currentUserNotRoot: + case tc.wantLocalGroups: var groupFile string groupFileOutput, groupFile = prepareGroupFiles(t) if tc.wantLocalGroups { groupFileOutput = groupFile } - args := []testutils.DaemonOption{ + socketPath = runAuthd(t, + testutils.WithCurrentUserAsRoot, testutils.WithGroupFile(groupFile), testutils.WithGroupFileOutput(groupFileOutput), - } - if !tc.currentUserNotRoot { - args = append(args, testutils.WithCurrentUserAsRoot) - } - socketPath = runAuthd(t, args...) + ) default: socketPath, groupFileOutput = sharedAuthd(t) } @@ -798,11 +788,10 @@ func TestNativeChangeAuthTok(t *testing.T) { tests := map[string]struct { username string - clientOptions clientOptions - currentUserNotRoot bool - skipRunnerCheck bool - expectedUser string - expectedExitCode int + clientOptions clientOptions + skipRunnerCheck bool + expectedUser string + expectedExitCode int test func(t *testing.T, c *ptytest.Console) testWithSignals func(t *testing.T, c *ptytest.Console, signalFn func(username string)) @@ -953,13 +942,6 @@ func TestNativeChangeAuthTok(t *testing.T) { nativeWaitForChangeAuthTokResult(t, c) }, }, - "Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate": { - currentUserNotRoot: true, - test: func(t *testing.T, c *ptytest.Console) { - t.Helper() - nativeWaitForChangeAuthTokResult(t, c) - }, - }, "Exit_authd_if_local_broker_is_selected": { test: func(t *testing.T, c *ptytest.Console) { t.Helper() @@ -984,17 +966,12 @@ func TestNativeChangeAuthTok(t *testing.T) { t.Run(name, func(t *testing.T) { t.Parallel() - var socketPath string - if tc.currentUserNotRoot { - socketPath = runAuthd(t, testutils.WithGroupFile(filepath.Join(t.TempDir(), "group"))) - } else { - socketPath, _ = sharedAuthd(t) - } + socketPath, _ := sharedAuthd(t) clientOptions := tc.clientOptions username := tc.username expectedUser := tc.expectedUser - if clientOptions.PamUser == "" && username == "" && !tc.currentUserNotRoot { + if clientOptions.PamUser == "" && username == "" { username = testUserName(t, "native-passwd") } if expectedUser == "" { @@ -1110,16 +1087,14 @@ func nativeWaitForLoginPasswordPrompt(t *testing.T, c *ptytest.Console) { } } -// nativeWaitForResult waits for the PAM runner result line. +// nativeWaitForResult waits for the PAM runner Authenticate result line. func nativeWaitForResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionAuthenticate) } // nativeWaitForChangeAuthTokResult waits for the PAM runner ChangeAuthTok result. -// AcctMgmt is the last action to complete, so waiting for it ensures the whole -// authentication token change has finished. func nativeWaitForChangeAuthTokResult(t *testing.T, c *ptytest.Console) { t.Helper() - waitForRunnerResult(t, c, pam_test.RunnerResultActionAcctMgmt) + waitForRunnerResult(t, c, pam_test.RunnerResultActionChangeAuthTok) } diff --git a/pam/integration-tests/ssh_test.go b/pam/integration-tests/ssh_test.go index df20fe8c62..3dcb718cbe 100644 --- a/pam/integration-tests/ssh_test.go +++ b/pam/integration-tests/ssh_test.go @@ -659,10 +659,11 @@ func createSSHDServiceFile(t *testing.T, module, execChild, mkHomeModule, socket {Action: pam_test.Auth, Control: pam_test.Required, Module: "pam_unix.so"}, {Action: pam_test.Account, Control: pam_test.NewControl(accountControl), Module: module, Args: moduleArgs}, - { - Action: pam_test.Account, Control: pam_test.Optional, Module: "pam_echo.so", - Args: []string{fmt.Sprintf("%s finished for user '%%u'", pam_test.RunnerResultActionAcctMgmt.Message(""))}, - }, + // pam_permit provides a fallback PAM_SUCCESS so that account management + // succeeds even when the authd module returns PAM_IGNORE (e.g. for local + // users). In a real system other primary modules (e.g. pam_unix) fill + // this role; in the test environment authd is the only account module. + {Action: pam_test.Account, Control: pam_test.Required, Module: pam_test.Permit.String()}, {Action: pam_test.Session, Control: pam_test.Optional, Module: mkHomeModule, Args: []string{"debug", "skel=" + skelDir}}, {Action: pam_test.Session, Control: pam_test.Requisite, Module: pam_test.Permit.String()}, }) diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group index 4abd34bffe..045ae0cd42 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-local-groups-integration-auth-cli@example.com" Result: success -PAM AcctMgmt() - User: "user-local-groups-integration-auth-cli@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset index 40282c68d7..9de5dba592 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_offer_password_reset @@ -37,7 +37,4 @@ New password: PAM Authenticate() User: "user-can-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index dbd2283774..52afcb4cc6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -60,7 +60,4 @@ Confirm password: PAM Authenticate() User: "user-needs-reset-integration-mandatory@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-mandatory@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection index e3c9816216..7af3a74caa 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection @@ -61,9 +61,6 @@ Confirm password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login (UPPERCASE) === @@ -84,9 +81,6 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login (Mixed Case) === @@ -107,7 +101,4 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-authenticate-user-and-reset-password-with-case-insensitive-user-selection@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully index 2de96b81c2..557b532819 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-simple-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user index f85a26a403..52729238e3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_after_trying_empty_user @@ -26,7 +26,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-was-empty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-was-empty@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout index c609309b6d..c5adeb289d 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-invalid-timeout-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-invalid-timeout-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method index 78fae32a65..e5b0bf8d58 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_password_only_supported_method @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-cli@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-cli@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user index 802001d51b..30c79ac43f 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_preset_user @@ -16,7 +16,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-preset-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-preset-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case index e93cbc4abf..cb21aec151 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-upper-case-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-upper-case-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user index 376fa04d86..d58650a01a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_successfully_with_upper_case_preset_user @@ -16,7 +16,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-preset-upper-case-testcliauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-preset-upper-case-testcliauthenticate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode index da7224bc48..2148a0fce3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_auth_mode @@ -72,7 +72,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-switch-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-switch-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker index 6004ff7618..e3e2b2384f 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_to_local_broker @@ -43,8 +43,4 @@ PAM Authenticate() User: "user-integration-switch-broker@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-switch-broker@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username index 29f0524954..4057bf1cfb 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_switching_username @@ -31,7 +31,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-username-switched@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-username-switched@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button index d4d75a4b01..d5b9b8db74 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_form_mode_with_button @@ -50,7 +50,4 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-form-w-button@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-form-w-button@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa index cb5fbc9897..deeafa5253 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa @@ -70,7 +70,4 @@ Unlock your phone +33... or accept request on web interface PAM Authenticate() User: "user-mfa@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index 1084e45e04..8e294f8969 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -117,7 +117,4 @@ Confirm password: PAM Authenticate() User: "user-mfa-with-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code index 43d1a6f11d..f1daa0ee98 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code @@ -160,7 +160,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations index f641231f74..7cfe2cad9b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_after_many_regenerations @@ -56,7 +56,4 @@ Code: 1337 PAM Authenticate() User: "user-integration-qrcode-static-regenerate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qrcode-static-regenerate@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY index c964431a56..71b7665e38 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-tty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-tty@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session index ada4ff87f7..bbd62002c3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-tty-session@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-tty-session@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen index 831be6e995..d548db6532 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_user_with_qr_code_in_screen @@ -242,7 +242,4 @@ Code: 1341 PAM Authenticate() User: "user-integration-qr-code-screen@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qr-code-screen@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments index b102e352d8..3df5add7b0 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Authenticate_with_warnings_on_unsupported_arguments @@ -22,7 +22,4 @@ Gimme your password: PAM Authenticate() User: "user2@example.com" Result: success -PAM AcctMgmt() - User: "user2@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user index 2e256b0dc6..a386f3f53d 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user @@ -7,8 +7,4 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset index 184b624581..5b460b5c47 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Autoselect_local_broker_for_local_user_preset @@ -3,8 +3,4 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root deleted file mode 100644 index ab268aa9a4..0000000000 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root +++ /dev/null @@ -1,11 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM Authenticate() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch -──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached index accb5f858d..de4f1642a8 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_max_attempts_reached @@ -43,9 +43,4 @@ PAM Authenticate() User: "user-integration-max-attempts@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-max-attempts@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 3598b697bc..fdc1d6eeb2 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -135,7 +135,4 @@ Confirm password: PAM Authenticate() User: "user-needs-reset@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist index 1b21f45269..1164720d0a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Deny_authentication_if_user_does_not_exist @@ -19,9 +19,4 @@ PAM Authenticate() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd index a9fa271862..7cc10ec7f6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Error_if_cannot_connect_to_authd @@ -3,9 +3,4 @@ PAM Authenticate() User: "" Result: error: PAM exit code: 9 Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected index 894945a2cd..4ba7f407c3 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_local_broker_is_selected @@ -19,8 +19,4 @@ PAM Authenticate() User: "user-local-broker" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-local-broker" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d index 734eb23bff..1e7f44f437 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_presses_ctrl_d @@ -22,9 +22,4 @@ PAM Authenticate() User: "user-integration-ctrl-d@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-ctrl-d@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints index f9a032b32b..15a8be8eda 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_authd_if_user_sigints @@ -22,9 +22,4 @@ PAM Authenticate() User: "user-integration-sigint@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-sigint@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped index af611cb206..e8c12c0825 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Exit_if_authd_is_stopped @@ -5,9 +5,4 @@ PAM Authenticate() User: "" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username index ae464fbbcb..e5c174dd22 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Prevent_user_from_switching_username @@ -38,7 +38,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-pam-preset@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pam-preset@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode index 6163ce476a..f1fa136ccf 100644 --- a/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestCLIAuthenticate/Remember_last_successful_broker_and_mode @@ -44,9 +44,6 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-remember-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-remember-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Second Login (broker/mode remembered) === @@ -71,7 +68,4 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-remember-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-remember-mode@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth index b8dd7227bf..2d5706519b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_passwd_after_MFA_auth @@ -102,7 +102,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-mfa-integration-cli-passwd@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-cli-passwd@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one index af45733a71..2638ecea9c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one @@ -55,9 +55,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login === @@ -78,7 +75,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-change-password-successfully-and-authenticate-with-new-one@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case index efa3f440d1..9dae08fd47 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case @@ -55,9 +55,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-case-insensitive-testclichangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testclichangeauthtok@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── === Login === @@ -78,7 +75,4 @@ Gimme your password: PAM Authenticate() User: "user-integration-case-insensitive-testclichangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testclichangeauthtok@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected index 366166c4c8..679cdc4d8e 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_local_broker_is_selected @@ -19,8 +19,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d index 58277b2fd4..5f7707d180 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_presses_ctrl_d @@ -22,9 +22,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-user-presses-ctrl-d@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-user-presses-ctrl-d@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints index 3124fabec0..e7d615ff44 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Exit_authd_if_user_sigints @@ -22,9 +22,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com" Result: error: PAM exit code: 26 Critical error - immediate abort -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-exit-authd-if-user-sigints@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails index cb35990959..d5131a331c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_auth_fails @@ -43,9 +43,4 @@ PAM ChangeAuthTok() User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-integration-cli-passwd-prevent-change-password-if-auth-fails@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate deleted file mode 100644 index 7b95989d89..0000000000 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate +++ /dev/null @@ -1,11 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM ChangeAuthTok() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch -──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist index 3a7a3bbe22..b7a2b87f5a 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Prevent_change_password_if_user_does_not_exist @@ -19,9 +19,4 @@ PAM ChangeAuthTok() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -PAM Info Message: acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria index cb2bde7029..aa9bd20f87 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria @@ -129,7 +129,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker index 9e2c81f226..ea03b3d5f6 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_rejected_by_broker @@ -88,9 +88,6 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── Username: user name ──────────────────────────────────────────────────────────────────────────────── @@ -175,7 +172,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous index a2d6666f1d..fe1906bd6b 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_new_password_is_same_of_previous @@ -70,7 +70,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-new-password-is-same-of-previous@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same index 9542152cc1..c26b508b4c 100644 --- a/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same +++ b/pam/integration-tests/testdata/golden/TestCLIChangeAuthTok/Retry_if_password_confirmation_is_not_the_same @@ -88,7 +88,4 @@ Confirm password: PAM ChangeAuthTok() User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-cli-passwd-retry-if-password-confirmation-is-not-the-same@example.com" - Result: success ──────────────────────────────────────────────────────────────────────────────── diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset index 4e99fd10f1..e9af1ce633 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_accept_password_reset @@ -23,6 +23,3 @@ Confirm Password: PAM Authenticate() User: "user-can-reset-integration-accept-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset-integration-accept-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group index 283f003489..467155af4b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-local-groups-integration-auth-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-local-groups-integration-auth-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset index fc841d2619..7bdb0e373b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_offer_password_reset @@ -17,6 +17,3 @@ Choose action: PAM Authenticate() User: "user-can-reset-integration-skip-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-can-reset-integration-skip-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index 8a08473215..7fbc125505 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -17,6 +17,3 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-mandatory-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-mandatory-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection index caa6cf0292..9e1f8ce3b3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_and_reset_password_with_case_insensitive_user_selection @@ -19,9 +19,6 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success Username: USER-NEEDS-RESET-INTEGRATION-CASE-INSENSITIVE-NATIVE-TESTNATIVEAUTHENTICATE@EXAMPLE.COM == Password authentication == @@ -31,9 +28,6 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success Username: user-needs-reset-integration-Case-INSENSITIVE-native-testnativeauthenticate@example.com == Password authentication == @@ -43,6 +37,3 @@ Gimme your password: PAM Authenticate() User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-case-insensitive-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service index 695081750c..cfec047d41 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-service-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-service-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env index 31a86622a6..73f310afad 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_auth_info_env @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-auth-info-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-auth-info-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env index 02c179e7dd..7f5db7b541 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_on_ssh_service_with_custom_name_and_connection_env @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-pre-check-ssh-connection-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-connection-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully index 468de97916..bd5850d2ce 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-user-successfully@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-successfully@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection index 336935bb83..22503cc904 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_using_upper_case_with_user_selection @@ -12,6 +12,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-selection-upper-case-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout index 3fd426641d..39aee02516 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_invalid_connection_timeout @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-user-successfully-with-invalid-connection-timeout@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-successfully-with-invalid-connection-timeout@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method index 399a64dd3d..643e4da66b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit index dad714ac5d..b9f46ceb97 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_password_only_supported_method_in_polkit @@ -4,6 +4,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password-integration-polkit-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password-integration-polkit-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case index ca78d29b15..7fe15fd1a8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_upper_case @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-upper-case-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-upper-case-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection index 5ae2bb2c05..fc9de3aa1f 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_successfully_with_user_selection @@ -12,6 +12,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-user-selection-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-user-selection-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode index 6dd800538c..ea4b7e8cc0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_auth_mode @@ -180,6 +180,3 @@ Enter your pin code: PAM Authenticate() User: "user-integration-switch-mode-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-switch-mode-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker index 54aa4c1eef..2fba4baee0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_to_local_broker @@ -38,7 +38,3 @@ PAM Authenticate() User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-switching-to-local-broker@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username index d9b27f6ac5..463ad5583b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_switching_username @@ -19,6 +19,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-username-switched-authenticate-user-switching-username@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-username-switched-authenticate-user-switching-username@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button index c931466030..c7bf941026 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button @@ -38,6 +38,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-form-mode-with-button@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit index 479bce37ef..8efc9f9c2b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_in_polkit @@ -31,6 +31,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-form-mode-with-button-in-polkit@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods index 1505df8bee..f8b0855010 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_form_mode_with_button_two_supported_methods @@ -32,6 +32,3 @@ Enter your one time credential: PAM Authenticate() User: "user-auth-modes-totp_with_button,password-integration-native@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-totp_with_button,password-integration-native@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa index 87a78d2068..9ccc44170b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa @@ -56,6 +56,3 @@ Plug your fido device and press with your thumb: PAM Authenticate() User: "user-mfa-integration-auth-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-auth-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index 440f3b8ab1..d68b1689ca 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -38,6 +38,3 @@ Confirm Password: PAM Authenticate() User: "user-mfa-with-reset-integration-pwquality-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset-integration-pwquality-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password index a90b2a5c4c..9c3a3c38c3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_mfa_and_reset_same_password @@ -28,6 +28,3 @@ Confirm Password: PAM Authenticate() User: "user-mfa-with-reset-integration-same-password-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-with-reset-integration-same-password-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code index 36ba910b70..2be7f37fa2 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code @@ -164,6 +164,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY index c63d84655b..90c63b4ad5 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session index 10c33fe29d..fbdc7b3d35 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_a_TTY_session @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-a-tty-session@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen index 81bb5bc3cc..84f63a4c00 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_screen @@ -246,6 +246,3 @@ Choose action: PAM Authenticate() User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-user-with-qr-code-in-screen@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh index a37bad3c2c..d3bba62e9e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_in_ssh @@ -77,6 +77,3 @@ Choose action: PAM Authenticate() User: "user-integration-pre-check-ssh-service-qr-code-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-pre-check-ssh-service-qr-code-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code index aad56a646b..814ebc5d9d 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_user_with_qr_code_without_code @@ -157,6 +157,3 @@ Choose action: PAM Authenticate() User: "user-integration-qrcode-without-code-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-qrcode-without-code-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments index b6b672ddb5..04637db022 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Authenticate_with_warnings_on_unsupported_arguments @@ -10,6 +10,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-authenticate-with-warnings-on-unsupported-arguments@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user index 7e44dfa810..58cf2c04a0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user @@ -4,7 +4,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit index 7e44dfa810..58cf2c04a0 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_on_polkit @@ -4,7 +4,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset index c8323fe627..1c0594ad7a 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset @@ -3,7 +3,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit index c8323fe627..1c0594ad7a 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Autoselect_local_broker_for_local_user_preset_on_polkit @@ -3,7 +3,3 @@ PAM Authenticate() User: "root" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "root" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root deleted file mode 100644 index 050be9b20d..0000000000 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_current_user_is_not_considered_as_root +++ /dev/null @@ -1,10 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM Authenticate() - User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-deny-authentication-if-current-user-is-not-considered-as-root@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached index d13d421358..b9e189f0e8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_max_attempts_reached @@ -32,8 +32,3 @@ PAM Authenticate() User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-deny-authentication-if-max-attempts-reached@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 55f5e98e17..4a66ffdc1b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -39,6 +39,3 @@ Confirm Password: PAM Authenticate() User: "user-needs-reset-integration-bad-password-native-testnativeauthenticate@example.com" Result: success -PAM AcctMgmt() - User: "user-needs-reset-integration-bad-password-native-testnativeauthenticate@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist index 76f7fd3315..d33398432e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist @@ -8,8 +8,3 @@ PAM Authenticate() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key index 877ff14912..fd75996887 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Deny_authentication_if_user_does_not_exist_and_matches_cancel_key @@ -14,8 +14,3 @@ PAM Authenticate() User: "r" Result: error: PAM exit code: 7 Authentication failure -acct=incomplete -PAM AcctMgmt() - User: "r" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd index 4672140345..68cd8ff192 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Error_if_cannot_connect_to_authd @@ -3,8 +3,3 @@ PAM Authenticate() User: "user-integration-native-error-if-cannot-connect-to-authd@example.com" Result: error: PAM exit code: 9 Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-error-if-cannot-connect-to-authd@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected index 9c66446065..6f59bfcc51 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_authd_if_local_broker_is_selected @@ -8,7 +8,3 @@ PAM Authenticate() User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped index dd0f496b21..6516897e2b 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_authd_is_stopped @@ -8,8 +8,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-authd-is-stopped@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-exit-if-authd-is-stopped@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env index 4dd8cbb568..d3dfeb054e 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_auth_info_env @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-auth-info-env@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env index d48f1a8edb..791c6a73cf 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_custom_ssh_service_with_connection_env @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-custom-ssh-service-with-connection-env@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service index 91e8643d94..f715a61b58 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Exit_if_user_is_not_pre-checked_on_ssh_service @@ -3,7 +3,3 @@ PAM Authenticate() User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-exit-if-user-is-not-pre-checked-on-ssh-service@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username index b1471bfc5b..b4f52fcf48 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Prevent_preset_user_from_switching_username @@ -40,6 +40,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-native-prevent-preset-user-from-switching-username@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-prevent-preset-user-from-switching-username@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode index d005aae478..8f80ce59f6 100644 --- a/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestNativeAuthenticate/Remember_last_successful_broker_and_mode @@ -32,9 +32,6 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" - Result: success == Authentication code == 1. Proceed with Authentication code @@ -49,6 +46,3 @@ Enter your one time credential: PAM Authenticate() User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-remember-last-successful-broker-and-mode@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth index df7c5907d4..d151f5e767 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_passwd_after_MFA_auth @@ -63,6 +63,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-mfa-integration-native-passwd-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-mfa-integration-native-passwd-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one index 406dbe8710..fedf0a9fc3 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one @@ -18,9 +18,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-simple-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testnativechangeauthtok@example.com" - Result: success Username: user-integration-simple-testnativechangeauthtok@example.com == Password authentication == @@ -30,6 +27,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-simple-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-simple-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case index a95431829b..7974c0c245 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_different_case @@ -18,9 +18,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" - Result: success Username: user-integration-case-insensitive-testnativechangeauthtok@example.com == Password authentication == @@ -30,6 +27,3 @@ Gimme your password: PAM Authenticate() User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-case-insensitive-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method index b8628fc56e..f20234f494 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Change_password_successfully_and_authenticate_with_new_one_with_single_broker_and_password_only_supported_method @@ -9,9 +9,6 @@ Confirm Password: PAM ChangeAuthTok() User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" - Result: success == Password authentication == Enter 'r' to cancel the request and go back to select the authentication method @@ -20,6 +17,3 @@ Gimme your password: PAM Authenticate() User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" Result: success -PAM AcctMgmt() - User: "user-auth-modes-password,mandatoryreset-integration-polkit-testnativechangeauthtok@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected index 07d50ad1ea..cc8d985323 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Exit_authd_if_local_broker_is_selected @@ -10,7 +10,3 @@ PAM ChangeAuthTok() User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com" Result: error: PAM exit code: 25 The return value should be ignored by PAM dispatch -PAM AcctMgmt() - User: "user-integration-native-passwd-exit-authd-if-local-broker-is-selected@example.com" - Result: error: PAM exit code: 26 - Critical error - immediate abort diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails index 2c95eb34ec..391dfdf268 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_auth_fails @@ -34,8 +34,3 @@ PAM ChangeAuthTok() User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com" Result: error: PAM exit code: 11 Have exhausted maximum number of retries for service -acct=incomplete -PAM AcctMgmt() - User: "user-integration-native-passwd-prevent-change-password-if-auth-fails@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate deleted file mode 100644 index f882dcf20d..0000000000 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_current_user_is_not_root_as_can_not_authenticate +++ /dev/null @@ -1,10 +0,0 @@ -PAM Error Message: could not get current available brokers: permission denied: only root can perform this operation -PAM ChangeAuthTok() - User: "" - Result: error: PAM exit code: 9 - Authentication service cannot retrieve authentication info -acct=incomplete -PAM AcctMgmt() - User: "" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist index d2b117879d..c283531c57 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Prevent_change_password_if_user_does_not_exist @@ -10,8 +10,3 @@ PAM ChangeAuthTok() User: "user-unexistent@example.com" Result: error: PAM exit code: 4 System error -acct=incomplete -PAM AcctMgmt() - User: "user-unexistent@example.com" - Result: error: PAM exit code: 25 - The return value should be ignored by PAM dispatch diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria index 311b67b975..73fd925105 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_does_not_match_quality_criteria @@ -45,6 +45,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-does-not-match-quality-criteria@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker index ac800e9acf..91dfee1622 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_rejected_by_broker @@ -25,6 +25,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-is-rejected-by-broker@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous index 493ec54a86..f643fbd924 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_new_password_is_same_of_previous @@ -23,6 +23,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-new-password-is-same-of-previous@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same index 4f4e6f60db..30fccea2e8 100644 --- a/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same +++ b/pam/integration-tests/testdata/golden/TestNativeChangeAuthTok/Retry_if_password_confirmation_is_not_the_same @@ -25,6 +25,3 @@ Confirm Password: PAM ChangeAuthTok() User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com" Result: success -PAM AcctMgmt() - User: "user-integration-native-passwd-retry-if-password-confirmation-is-not-the-same@example.com" - Result: success diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset index ae4281bcb1..df09411b7f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset @@ -21,7 +21,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_accept_password_reset] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd index 8de58d6267..36669acedd 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_accept_password_reset_with_shared_sshd @@ -21,7 +21,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-accept-password-reset-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group index 1bd6c6f96d..cdb8a742bb 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com' -PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group] HOME=${AUTHD_TEST_HOME} LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd index bb77b7f20e..51f82205bb 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_add_it_to_local_group_with_shared_sshd] HOME=${AUTHD_TEST_HOME} LOGNAME=user-local-groups-integration-pre-check-ssh-authenticate-user-and-add-it-to-local-group-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset index fb8080c31e..c54ec6bcf2 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset @@ -15,7 +15,6 @@ Or enter 'r' to go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com@localhost) Choose action: > 2 PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_offer_password_reset] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd index 64a2acd441..18a0e12d89 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_offer_password_reset_with_shared_sshd @@ -15,7 +15,6 @@ Or enter 'r' to go back to choose the provider (user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com@localhost) Choose action: > 2 PAM Authenticate() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-can-reset-integration-pre-check-ssh-authenticate-user-and-offer-password-reset-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 index ae656f2729..dbd6f3eb77 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04 @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com @@ -33,7 +32,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd index 5fca67c714..03abd99d31 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_allow_uppercase_re-login_on_ubuntu_24.04_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com @@ -33,7 +32,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-NEEDS-RESET-INTEGRATION-PRE-CHECK-CASE-INSENSITIVE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 index 0975f1b2f3..76db1bb398 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04 @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd index 80a039dbc3..427c4f7c30 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_then_deny_uppercase_re-login_on_ubuntu_26.04_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-case-insensitive-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy index f06884d408..3f30d88d3a 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd index 1302d90d34..b8e8f103f6 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_and_reset_password_while_enforcing_policy_with_shared_sshd @@ -15,7 +15,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-authenticate-user-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it index dab285f832..03fadd08dd 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com @@ -42,7 +41,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd index eefdb0f1f2..da8bb8b666 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_locks_and_unlocks_it_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com @@ -42,7 +41,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-locks-and-unlocks-it-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully index 5901bdb1c7..8ecb692893 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell index a416f110ab..97a9d83ff1 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd index a0012868bd..d146c239f6 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_and_enters_shell_with_shared_sshd] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-and-enters-shell-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered index 38113540f5..ec64a1d20f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-ssh@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh@example.com' -PAM AcctMgmt() finished for user 'user-ssh@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd index acbadfec69..6923437a96 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-ssh@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh@example.com' -PAM AcctMgmt() finished for user 'user-ssh@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 index 1d591e1fd5..70022fca98 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04 @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-SSH2@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh2@example.com' -PAM AcctMgmt() finished for user 'user-ssh2@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh2@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd index a93ef27492..dbc91b268d 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_if_already_registered_with_upper_case_on_ubuntu_24.04_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-SSH2@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-ssh2@example.com' -PAM AcctMgmt() finished for user 'user-ssh2@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-ssh2@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd index 7dc0e511c7..43f4e11aa3 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-successfully-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 index 1f8f005992..7c9be52fab 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04 @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd index 8fac1364b8..d8ad6afcc4 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_successfully_with_upper_case_on_ubuntu_24.04_with_shared_sshd @@ -8,7 +8,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (USER-INTEGRATION-PRE-CHECK-UPPER-CASE-TESTSSHAUTHENTICATE@EXAMPLE.COM@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-upper-case-testsshauthenticate@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-upper-case-testsshauthenticate@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode index 746826e561..ad99f65bea 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode @@ -161,7 +161,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com@localhost) Enter your pin code: > 4242 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_switching_auth_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd index 44d9ea14b3..1b0f5345f2 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_switching_auth_mode_with_shared_sshd @@ -161,7 +161,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com@localhost) Enter your pin code: > 4242 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-switching-auth-mode-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button index 509202e9f9..0e10167ba3 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com@localhost) Enter your one time credential: > temporary pass00 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd index 9b1a519f8c..7a05f2005b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_form_mode_with_button_with_shared_sshd @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass00 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-form-mode-with-button-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa index 462f94d74f..49d6b8d572 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa @@ -54,7 +54,6 @@ Press Enter to wait for authentication or enter 'r' to go back to select the aut (user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com@localhost) Plug your fido device and press with your thumb: > PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com' -PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy index e2bb4428ab..025b1906e1 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd index c71e3cd6bf..f941ca90e8 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_password_while_enforcing_policy_with_shared_sshd @@ -36,7 +36,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-password-while-enforcing-policy-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password index 2b26284681..5528331944 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password @@ -26,7 +26,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd index 6d28bba64f..4ccebed8c7 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_and_reset_same_password_with_shared_sshd @@ -26,7 +26,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-with-reset-integration-pre-check-ssh-authenticate-user-with-mfa-and-reset-same-password-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd index a9ccb6cb46..98803ce75b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_mfa_with_shared_sshd @@ -54,7 +54,6 @@ Press Enter to wait for authentication or enter 'r' to go back to select the aut (user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com@localhost) Plug your fido device and press with your thumb: > PAM Authenticate() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-mfa-integration-pre-check-ssh-authenticate-user-with-mfa-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code index 7d82a9fcc4..cd93c6c352 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code @@ -75,7 +75,6 @@ Or enter 'r' to go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com@localhost) Choose action: > 1 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Authenticate_user_with_qr_code] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd index 708cb8016a..2e722fdc5a 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Authenticate_user_with_qr_code_with_shared_sshd @@ -75,7 +75,6 @@ Or enter 'r' to go back to select the authentication method (user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com@localhost) Choose action: > 1 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-authenticate-user-with-qr-code-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria index 6fe9c36d2e..68b9ea8d99 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria @@ -42,7 +42,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd index 929b18daa3..1cfc1786df 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Deny_authentication_if_newpassword_does_not_match_required_criteria_with_shared_sshd @@ -42,7 +42,6 @@ Enter 'r' to cancel the request and go back to choose the provider (user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com@localhost) Confirm Password: > PAM Authenticate() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-needs-reset-integration-pre-check-ssh-deny-authentication-if-newpassword-does-not-match-required-criteria-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username index 0ae33e4ff6..3786e7af62 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username @@ -38,7 +38,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Prevent_user_from_switching_username] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd index 5c72e0810f..6acfe12f85 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Prevent_user_from_switching_username_with_shared_sshd @@ -38,7 +38,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com@localhost) Gimme your password: > PAM Authenticate() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-prevent-user-from-switching-username-with-shared-sshd@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode index 68ea022dd1..5da1ab5c8f 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode @@ -30,7 +30,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com @@ -54,7 +53,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate/Remember_last_successful_broker_and_mode] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode@example.com diff --git a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd index 014d739206..af61f0be2b 100644 --- a/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd +++ b/pam/integration-tests/testdata/golden/TestSSHAuthenticate/Remember_last_successful_broker_and_mode_with_shared_sshd @@ -30,7 +30,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com @@ -54,7 +53,6 @@ Enter 'r' to cancel the request and go back to select the authentication method (user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com@localhost) Enter your one time credential: > temporary pass0 PAM Authenticate() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' -PAM AcctMgmt() finished for user 'user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com' SSHD: Connected to ssh via authd module! [TestSSHAuthenticate] HOME=${AUTHD_TEST_HOME} LOGNAME=user-integration-pre-check-ssh-remember-last-successful-broker-and-mode-with-shared-sshd@example.com diff --git a/pam/internal/pam_test/pam-client-dummy.go b/pam/internal/pam_test/pam-client-dummy.go index f8844d398d..652dbc813b 100644 --- a/pam/internal/pam_test/pam-client-dummy.go +++ b/pam/internal/pam_test/pam-client-dummy.go @@ -51,7 +51,6 @@ type options struct { endSessionErr error brokerForUser map[string]string - setBrokerErr error uiLayouts map[string]*authd.UILayout authModes map[string]*authd.GAMResponse_AuthenticationMode @@ -174,13 +173,6 @@ func WithEndSessionReturn(err error) func(o *options) { } } -// WithSetBrokerReturn is the option to define the SetBroker return values. -func WithSetBrokerReturn(err error) func(o *options) { - return func(o *options) { - o.setBrokerErr = err - } -} - // WithUILayout is the option to define the UI layouts supported return values. func WithUILayout(authModeID string, label string, uiLayout *authd.UILayout) func(o *options) { return func(o *options) { @@ -516,27 +508,6 @@ func (dc *DummyClient) EndSession(ctx context.Context, in *authd.ESRequest, opts return &authd.Empty{}, nil } -// SetBroker simulates SetBroker using the provided parameters. -func (dc *DummyClient) SetBroker(ctx context.Context, in *authd.STBRequest, opts ...grpc.CallOption) (*authd.Empty, error) { - log.Debugf(ctx, "SetBroker Called: %#v", in) - dc.mu.Lock() - defer dc.mu.Unlock() - if dc.setBrokerErr != nil { - return nil, dc.setBrokerErr - } - if in == nil { - return nil, errors.New("no input values provided") - } - if in.Username == "" { - return nil, errors.New("no valid username provided") - } - if in.BrokerId == "" { - return nil, errors.New("no valid broker ID provided") - } - dc.brokerForUser[in.Username] = in.BrokerId - return &authd.Empty{}, nil -} - // Utility functions for testing purposes. // SelectedUsername returns the selected Username on the client. diff --git a/pam/internal/pam_test/pam-client-dummy_test.go b/pam/internal/pam_test/pam-client-dummy_test.go index 1c622db61f..bce5289cd4 100644 --- a/pam/internal/pam_test/pam-client-dummy_test.go +++ b/pam/internal/pam_test/pam-client-dummy_test.go @@ -1162,67 +1162,6 @@ func TestEndSession(t *testing.T) { } } -func TestSetDefaultBrokerForUser(t *testing.T) { - t.Parallel() - - testCases := map[string]struct { - client authd.PAMClient - args *authd.STBRequest - - wantError error - }{ - "With_empty_options": { - client: NewDummyClient(nil), - wantError: errors.New("no input values provided"), - }, - "With_Error_return_value": { - client: NewDummyClient(nil, WithSetBrokerReturn(errTest)), - wantError: errTest, - }, - "With_valid_arguments": { - client: NewDummyClient(nil, WithSetBrokerReturn(nil)), - args: &authd.STBRequest{ - BrokerId: "broker-id", - Username: "username", - }, - }, - - // Error cases - "Error_if_no_user_name_is_provided": { - client: NewDummyClient(nil), - args: &authd.STBRequest{BrokerId: "broker-id"}, - wantError: errors.New("no valid username provided"), - }, - "Error_if_no_broker_ID_is_provided": { - client: NewDummyClient(nil), - args: &authd.STBRequest{Username: "username"}, - wantError: errors.New("no valid broker ID provided"), - }, - } - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - t.Parallel() - - ret, err := tc.client.SetBroker(context.TODO(), tc.args) - require.Equal(t, err, tc.wantError) - if err != nil { - require.Nil(t, ret) - return - } - - require.Equal(t, &authd.Empty{}, ret) - - if tc.args == nil { - return - } - retBroker, err := tc.client.GetBroker(context.TODO(), - &authd.GBRequest{Username: tc.args.Username}) - require.NoError(t, err) - require.Equal(t, tc.args.BrokerId, retBroker.Broker) - }) - } -} - func TestMain(m *testing.M) { var err error privateKey, err = rsa.GenerateKey(rand.Reader, 2048) diff --git a/pam/internal/pam_test/runner-utils.go b/pam/internal/pam_test/runner-utils.go index 85f2e7a43a..23b6a50afe 100644 --- a/pam/internal/pam_test/runner-utils.go +++ b/pam/internal/pam_test/runner-utils.go @@ -82,8 +82,6 @@ const ( RunnerResultActionAuthenticate RunnerResultAction = iota // RunnerResultActionChangeAuthTok is the string for ChangeAuthTok action. RunnerResultActionChangeAuthTok - // RunnerResultActionAcctMgmt is the string for the AcctMgmt action. - RunnerResultActionAcctMgmt ) func (result RunnerResultAction) String() string { @@ -92,8 +90,6 @@ func (result RunnerResultAction) String() string { return "PAM Authenticate()" case RunnerResultActionChangeAuthTok: return "PAM ChangeAuthTok()" - case RunnerResultActionAcctMgmt: - return "PAM AcctMgmt()" default: panic(fmt.Sprintf("Invalid PAM result %d", result)) } diff --git a/pam/pam.go b/pam/pam.go index 3b2cf0dcc3..89b2b4a168 100644 --- a/pam/pam.go +++ b/pam/pam.go @@ -34,10 +34,6 @@ type pamModule struct { } const ( - // authenticationBrokerIDKey is the Key used to store the data in the - // PAM module for the second stage authentication to select the default - // broker for the current user. - authenticationBrokerIDKey = "authd.authentication-broker-id" // alreadyAuthenticatedKey is the Key used to store in the library that // we've already authenticated with this module and so that we should not @@ -328,10 +324,6 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran } defer closeConn() - if err := mTx.SetData(authenticationBrokerIDKey, nil); err != nil { - return err - } - var exitStatus adapter.PamReturnStatus appState := adapter.NewUIModel(mTx, pamClientType, mode, conn, &exitStatus) teaOpts = append(teaOpts, tea.WithFilter(adapter.MsgFilter)) @@ -346,9 +338,6 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran if shouldSendAuthMessage(pamClientType, exitStatus.Message(), true) { sendReturnMessageToPam(mTx, exitStatus) } - if err := mTx.SetData(authenticationBrokerIDKey, exitStatus.BrokerID); err != nil { - return err - } return nil case adapter.PamReturnError: @@ -365,89 +354,9 @@ func (h *pamModule) handleAuthRequest(mode authd.SessionMode, mTx pam.ModuleTran } } -// AcctMgmt sets any used brokerID as default for the user. -func (h *pamModule) AcctMgmt(mTx pam.ModuleTransaction, flags pam.Flags, args []string) (err error) { - parsedArgs, logArgsIssues := parseArgs(args) - closeLogging, err := initLogging(mTx, parsedArgs, flags) - defer closeLogging() - defer func() { - log.Debugf(context.TODO(), "AcctMgmt: exiting with error %v", err) - }() - if err != nil { - return err - } - logArgsIssues() - - // We ignore AcctMgmt in case we're loading the module through the exec client - serviceName, err := mTx.GetItem(pam.Service) - if err != nil { - log.Warningf(context.TODO(), "Impossible to get PAM service name: %v", err) - return pam.ErrIgnore - } - if serviceName == gdmServiceName && !gdm.IsPamExtensionSupported(gdm.PamExtensionCustomJSON) { - return pam.ErrIgnore - } - - brokerData, err := mTx.GetData(authenticationBrokerIDKey) - if err != nil && errors.Is(err, pam.ErrNoModuleData) { - return pam.ErrIgnore - } - if brokerData == nil { - // PAM can return no data without an error after that has been unset: - // See: https://github.com/linux-pam/linux-pam/pull/780 - return pam.ErrIgnore - } - - brokerIDUsedToAuthenticate, ok := brokerData.(string) - if !ok { - msg := fmt.Sprintf("broker data has an invalid type %#v", brokerData) - log.Errorf(context.TODO(), msg) - if err := showPamMessage(mTx, pam.ErrorMsg, msg); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - - return pam.ErrIgnore - } - - // Only set the brokerID as default if we stored one after authentication. - if brokerIDUsedToAuthenticate == "" { - return pam.ErrIgnore - } - - // Get current user for broker - user, err := mTx.GetItem(pam.User) - if err != nil { - log.Errorf(context.TODO(), "AcctMgmt: could not get user from PAM: %v", err) - return err - } - - if user == "" { - if err := showPamMessage(mTx, pam.ErrorMsg, "Can't get user from PAM"); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - return pam.ErrIgnore - } - - client, closeConn, err := newClient(parsedArgs) - if err != nil { - log.Debugf(context.TODO(), "%s", err) - return pam.ErrAuthinfoUnavail - } - defer closeConn() - - req := authd.STBRequest{ - BrokerId: brokerIDUsedToAuthenticate, - Username: user, - } - if _, err := client.SetBroker(context.TODO(), &req); err != nil { - msg := err.Error() - if err := showPamMessage(mTx, pam.ErrorMsg, msg); err != nil { - log.Warningf(context.TODO(), "Impossible to show PAM message: %v", err) - } - return pam.ErrIgnore - } - - return nil +// AcctMgmt is ignored because broker selection is now handled server-side during IsAuthenticated. +func (h *pamModule) AcctMgmt(_ pam.ModuleTransaction, _ pam.Flags, _ []string) error { + return pam.ErrIgnore } func newClientConnection(args map[string]string) (conn *grpc.ClientConn, closeConn func(), err error) { diff --git a/pam/tools/pam-runner/pam-runner.go b/pam/tools/pam-runner/pam-runner.go index 6d44a2c0ae..73fce12825 100644 --- a/pam/tools/pam-runner/pam-runner.go +++ b/pam/tools/pam-runner/pam-runner.go @@ -166,8 +166,6 @@ func main() { printPamResult(runnerAction.Result(), user, pamRes) - // Simulate setting auth broker as default. - printPamResult(pam_test.RunnerResultActionAcctMgmt, user, tx.AcctMgmt(pamFlags)) } func noConversationHandler(style pam.Style, msg string) (string, error) {