Fix AD pam and scripts

6 files changed, 23 insertions, 23 deletions

diff --git a/data/ad/common-account b/data/ad/common-account
index e06e539..a72effc 100644
--- a/data/ad/common-account
+++ b/data/ad/common-account
@@ -1,5 +1,5 @@
-account	[success=2 new_authtok_reqd=done default=ignore]	pam_unix.so 
-account	[success=1 default=ignore]	pam_ldap.so 
+account	[success=2 new_authtok_reqd=done default=ignore]	pam_unix.so
+account	[success=1 default=ignore]	pam_ldap.so
 # here's the fallback if no module succeeds
 account	requisite			pam_deny.so
 # prime the stack with a positive return value if there isn't one already;
diff --git a/data/ad/common-auth b/data/ad/common-auth
index c83e66e..952b3e2 100644
--- a/data/ad/common-auth
+++ b/data/ad/common-auth
@@ -8,5 +8,5 @@ auth	optional			pam_script.so expose=1
 # since the modules above will each just jump around
 auth	required			pam_permit.so
 # and here are more per-package modules (the "Additional" block)
-auth	optional			pam_cap.so 
+auth	optional			pam_cap.so
 
diff --git a/data/ad/common-password b/data/ad/common-password
index 4cda16c..a510306 100644
--- a/data/ad/common-password
+++ b/data/ad/common-password
@@ -7,5 +7,4 @@ password	requisite			pam_deny.so
 # since the modules above will each just jump around
 password	required			pam_permit.so
 # and here are more per-package modules (the "Additional" block)
-password	optional	pam_gnome_keyring.so 
 
diff --git a/data/ad/common-session b/data/ad/common-session
index 942af33..992bd9d 100644
--- a/data/ad/common-session
+++ b/data/ad/common-session
@@ -14,9 +14,7 @@ session required       pam_systemd.so
 session optional        pam_env.so readenv=1
 session optional        pam_env.so readenv=1 envfile=/etc/default/locale
 # and here are more per-package modules (the "Additional" block)
-session	required	pam_unix.so 
-session	optional			pam_ldap.so 
-session sufficient			pam_script.so 
-session	optional			pam_xdg_support.so 
-session	optional			pam_ck_connector.so nox11
+session	required	pam_unix.so
+session	optional			pam_ldap.so
+session sufficient			pam_script.so
 
diff --git a/data/ad/common-session-noninteractive b/data/ad/common-session-noninteractive
index 0279a53..d984b1d 100644
--- a/data/ad/common-session-noninteractive
+++ b/data/ad/common-session-noninteractive
@@ -11,7 +11,6 @@ session	required			pam_permit.so
 # See "man pam_umask".
 session optional			pam_umask.so
 # and here are more per-package modules (the "Additional" block)
-session	required	pam_unix.so 
-session	optional			pam_ldap.so 
-session	optional			pam_xdg_support.so 
+session	required	pam_unix.so
+session	optional			pam_ldap.so
 
diff --git a/data/ad/mountscript b/data/ad/mountscript
index 74c511e..a48ca3a 100644
--- a/data/ad/mountscript
+++ b/data/ad/mountscript
@@ -6,20 +6,24 @@
 
 if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
 	
-	# determine fileserver and share for home directories
-	touch "/tmp/ldapsearch.${PAM_USER}"
-	chmod 0600 "/tmp/ldapsearch.${PAM_USER}"
-	ldapsearch -x -LLL uid="${PAM_USER}" homeMount > "/tmp/ldapsearch.${PAM_USER}" 2>/dev/null || \
-	{ slxlog "pam-ad-ldapquery" "Could not query LDAP server for parameters of user '${PAM_USER}'."; exit 1; }
-	VOLUME=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^homeMount | head -n 1 | cut -d" " -f2)
-	[ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "LDAP server did not provide 'homeMount'. Aborting mount for ${PAM_USER}." && exit 1
+	if [ -z "$VOLUME" -o -z "$REAL_ACCOUNT" ]; then
+		# determine fileserver and share for home directories
+		touch "/tmp/ldapsearch.${PAM_USER}"
+		chmod 0600 "/tmp/ldapsearch.${PAM_USER}"
+		ldapsearch -x -LLL uid="${PAM_USER}" homeMount > "/tmp/ldapsearch.${PAM_USER}" 2>/dev/null || \
+			{ slxlog "pam-ad-ldapquery" "Could not query LDAP server for parameters of user '${PAM_USER}'."; exit 1; }
+		VOLUME=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^homeMount | head -n 1 | cut -d" " -f2)
+		[ -z "${VOLUME}" ] && slxlog "pam-ad-ldapvolume" "LDAP server did not provide 'homeMount'. Aborting mount for ${PAM_USER}." && exit 1
+		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT=$(cat "/tmp/ldapsearch.${PAM_USER}" | grep ^realAccount | head -n 1 | cut -d" " -f2)
+		[ -z "$REAL_ACCOUNT" ] && REAL_ACCOUNT="$PAM_USER"
+	fi
 	
-	MOUNT_OPTS="-t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm"
+	MOUNT_OPTS="-v -t cifs -o uid=${USER_UID},gid=${USER_GID},forceuid,forcegid,sec=ntlm"
 	
 	SIGNAL=$(mktemp)
 	rm -f -- "${SIGNAL}"
 	
-	export USER="${PAM_USER}"
+	export USER="${REAL_ACCOUNT}"
 	export PASSWD="${PAM_AUTHTOK}"
 	
 	( mount ${MOUNT_OPTS} "${VOLUME}" "${PERSISTENT_HOME_DIR}" > "/tmp/home.$PAM_USER" 2>&1 || touch "${SIGNAL}" ) &
@@ -30,11 +34,11 @@ if ! grep -q "^${PAM_USER}:" "/etc/passwd"; then
 	done
 	
 	if [ -e "${SIGNAL}" ]; then
-		slxlog "pam-reutlingen" "Mount of '${FILESERVER}/${PAM_USER}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' failed. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
 		sleep 1
 		rm -f -- "${SIGNAL}"
 	elif kill -9 "${MOUNT_PID}" 2>/dev/null; then
-		slxlog "pam-reutlingen" "Mount of '${FILESERVER}/${PAM_USER}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
+		slxlog "pam-ad-mount" "Mount of '${VOLUME}' to '${PERSISTENT_HOME_DIR}' timed out. (Args: ${MOUNT_OPTS})" "/tmp/home.$PAM_USER"
 		sleep 1
 	else
 		PERSISTENT_OK=yes