latest-pam_krb5+ldap.patch

--- pam_krb5/configure.ac       2014-04-03 06:15:22.247765619 -0600
+++ pam_krb5/configure.ac       2014-01-24 07:18:29.287670596 -0700
@@ -67,6 +67,33 @@
 fi
 AM_CONDITIONAL(AFS,[test "x$afs" = xyes])
 
+AC_ARG_WITH(ldap,
+AC_HELP_STRING(--with-ldap,[Enable OpenLDAP features for optional LDAP UID/GID mapping.]),
+                                                               ldap=$withval,
+                                                               ldap=AUTO)
+if test x$with_ldap = xyes ; then
+   AC_CHECK_HEADER([ldap.h], [:], [AC_MSG_ERROR([ldap.h not found! Please install the OpenLDAP libs.])])
+   LIBS="-lldap $LIBS $KRB5_LIBS $LIBSsave"
+   AC_CHECK_FUNC(ldap_initialization,,[AC_CHECK_LIB(ldap,ldap_initialization)])
+   AC_CHECK_FUNC(ldap_simple_bind_s,,[AC_CHECK_LIB(ldap,ldap_simple_bind_s)])
+   AC_CHECK_FUNC(ldap_search_s,,[AC_CHECK_LIB(ldap,ldap_search_s)])
+   AC_CHECK_FUNC(ldap_first_entry,,[AC_CHECK_LIB(ldap,ldap_first_entry)])
+   AC_CHECK_FUNC(ldap_get_values,,[AC_CHECK_LIB(ldap,ldap_get_values)])
+   AC_CHECK_FUNC(ldap_msgfree,,[AC_CHECK_LIB(ldap,ldap_msgfree)])
+   AC_CHECK_FUNC(ldap_unbind,,[AC_CHECK_LIB(ldap,ldap_unbind)])
+   AC_DEFINE(WITH_LDAP,1,[Define if you require OpenLDAP support.])
+   WITH_LDAP="yes"
+   AC_CHECK_HEADER([pwd.h], [:], [AC_MSG_ERROR([pwd.h not found! Please install the GNU libraries.])])
+   AC_CHECK_FUNC(putpwent,,[AC_CHECK_LIB(pwd,putpwent)])
+   AC_CHECK_HEADER([shadow.h], [:], [AC_MSG_ERROR([shadow.h not found! Please install the GNU libraries.])])
+   AC_CHECK_FUNC(lckpwdf,,[AC_CHECK_LIB(shadow,lckpwdf)])
+   AC_CHECK_FUNC(ulckpwdf,,[AC_CHECK_LIB(shadow,ulckpwdf)])
+   AC_CHECK_FUNC(putspent,,[AC_CHECK_LIB(shadow,putspent)])
+   AC_CHECK_HEADER([grp.h], [:], [AC_MSG_ERROR([grp.h not found! Please install the GNU libraries.])])
+   AC_CHECK_FUNC(fgetgrent,,[AC_CHECK_LIB(grp,fgetgrent)])
+fi
+AM_CONDITIONAL(WITH_LDAP,[test "x$with_ldap" = xyes])
+
 AC_ARG_WITH(default-chpw-prompt,
 [AC_HELP_STRING(--with-default-chpw-prompt="gnome-screensaver",[Set the default value of the "chpw_prompt" option (no default).])],
            DEFAULT_CHPW_PROMPT="$withval",
--- pam_krb5/src/ldap.c 1969-12-31 17:00:00.000000000 -0700
+++ pam_krb5/src/ldap.c 2014-04-02 08:42:28.021224719 -0600
@@ -0,0 +1,536 @@
+/*
+ * Copyright 2009-2011 Jason Gerfen jason.gerfen@gmail.com
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, and the entire permission notice in its entirety,
+ *    including the disclaimer of warranties.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior
+ *    written permission.
+ *
+ * ALTERNATIVELY, this product may be distributed under the terms of the
+ * GNU Lesser General Public License, in which case the provisions of the
+ * LGPL are required INSTEAD OF the above restrictions.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#define _GNU_SOURCE
+
+#include "../config.h"
+
+#include <strings.h>
+#include <ldap.h>
+#include <time.h>
+#include <errno.h>
+#include <limits.h>
+#include <stdio.h>
+#include <pwd.h>
+#include <grp.h>
+#include <shadow.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/file.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#ifdef HAVE_SECURITY_PAM_APPL_H
+#include <security/pam_appl.h>
+#endif
+
+#ifdef HAVE_SECURITY_PAM_MODULES_H
+#include <security/pam_modules.h>
+#endif
+
+#include KRB5_H
+#ifdef USE_KRB4
+#include KRB4_DES_H
+#include KRB4_KRB_H
+#ifdef KRB4_KRB_ERR_H
+#include KRB4_KRB_ERR_H
+#endif
+#endif
+
+#ifdef HAVE_KEYUTILS_H
+#include <keyutils.h>
+#endif
+
+#include "init.h"
+#include "log.h"
+#include "shmem.h"
+#include "stash.h"
+//#include "storetmp.h"
+#include "userinfo.h"
+//#include "v4.h"
+#include "v5.h"
+#include "xstr.h"
+
+extern char **comma_to_list (const char *);
+static char *members = NULL;
+int _putgrent_mod(const struct group *g, char *user, FILE *stream);
+
+int
+_check_ldap_options(struct _pam_krb5_options *options)
+{
+  if (!options->schema) { return(1); }
+  if (!options->ldapservs) { return(1); }
+  if (!options->ldapport) { return(1); }
+  if (!options->binddn) { return(1); }
+  if (!options->basedn) { return(1); }
+  if (!options->ldapuser) { return(1); }
+  if (!options->ldappass) { return(1); }
+  if (!options->passwd) { return(1); }
+  if (!options->shadow) { return(1); }
+  return(0);
+}
+
+int
+_check_ldap_results(struct _pam_krb5_user_info *userinfo)
+{
+  if (userinfo->uid == -1) { return(1); }
+  if (userinfo->gid == -1) { return(1); }
+  if (!userinfo->shell) { return(1); }
+  if (!userinfo->homedir) { return(1); }
+  return(0);
+}
+
+extern
+_ldap_search(struct _pam_krb5_options *options, char *user, struct _pam_krb5_user_info *userinfo)
+{
+  LDAP *ld;
+  LDAPMessage *res, *e;
+
+  int i, rc, port;
+  char *host, *base, buffer[80], **vals;
+  const char *attrs, *luser, *pass;
+
+  if (strcmp(options->schema, "ad")) {
+    attrs = "homeDirectory";
+  } else {
+    attrs = "msSFUHomeDirectory";
+  }
+
+  host = options->ldapservs;
+  port = atoi(options->ldapport);
+  luser = options->ldapuser;
+  pass = options->ldappass;
+  base = options->basedn;
+
+  if ((ld = ldap_init(host, port)) == NULL) {
+    crit("error connecting to %s - %s", options->ldapservs, ldap_err2string(ldap_init(host, port)));
+  } else {
+    if (ldap_simple_bind_s(ld, luser, pass) == LDAP_SUCCESS) {
+
+      snprintf(buffer, sizeof(buffer), "(&(objectCategory=Person)(anr=%s))", user);
+      warn("searching '%s' for '%s'...", options->basedn, user);
+      
+      if (ldap_search_s(ld, options->basedn, LDAP_SCOPE_SUBTREE, &buffer, NULL, 0, &res) != LDAP_SUCCESS) {
+       crit( "error occured while searching for '%s'", buffer);
+      }
+
+      if(ldap_first_entry(ld, res) == NULL) {
+       crit("'%s' not found in '%s' aborting authentication", user, options->basedn);
+      }
+
+      for (e = ldap_first_entry(ld, res); e != NULL; e = ldap_next_entry(ld, e)) {
+
+       vals = ldap_get_values(ld, e, "uidNumber");
+       for (i = 0; vals[i] != NULL; i++) {
+         if (vals[i] != NULL ) {
+           userinfo->uid = atoi(vals[i]);
+         } else {
+           userinfo->uid = -1;
+         }
+       }
+
+       vals = ldap_get_values(ld, e, "gidNumber");
+       for (i = 0; vals[i] != NULL; i++) {
+         if (vals[i] != NULL) {
+           userinfo->gid = atoi(vals[i]);
+         } else {
+           userinfo->gid = -1;
+         }
+       }
+
+       vals = ldap_get_values(ld, e, "loginShell");
+       for (i = 0; vals[i] != NULL; i++) {
+         if (vals[i] != NULL) {
+           if (options->defshell == NULL) {
+             userinfo->shell = vals[i];
+           } else {
+             userinfo->shell = options->defshell;
+           }
+         } else {
+           userinfo->shell = NULL;
+         }
+       }
+
+       vals = ldap_get_values(ld, e, attrs);
+       for (i = 0; vals[i] != NULL; i++) {
+         if (vals[i] != NULL) {
+           if (options->homedir == NULL) {
+             snprintf(buffer, sizeof(buffer), "%s%s", vals[i], user);
+             userinfo->homedir = xstrdup(buffer);
+           } else {
+             snprintf(buffer, sizeof(buffer), "%s/%s", options->homedir, user);
+             userinfo->homedir = xstrdup(buffer);
+           }
+         } else {
+           userinfo->homedir = NULL;
+         }
+       }
+
+       ldap_value_free(vals);
+
+      }
+      
+      ldap_msgfree(res);
+      ldap_unbind(ld);
+
+      return userinfo;
+
+    } else {
+      crit("error connection to ldap: '%s'", ldap_err2string(ldap_simple_bind_s(ld, luser, pass)));
+    }
+  }
+}
+
+int 
+_check_file(const char *file, int fd)
+{
+  struct stat orig_st;
+  struct stat new_st;
+
+  if (fd == 0) {
+    if (lstat(file, &orig_st) == -1) {
+      debug("'%s' is not a valid file", file);
+      return(1);
+    }
+   
+    if (!S_ISREG(orig_st.st_mode)) {
+      debug("'%s' is a symlink, cannot proceed", file);
+      return(1);
+    }
+  }
+
+  if (fd != 0 ) {
+    if (lstat(file, &orig_st) == -1) {
+      debug("'%s' is not a valid file", file);
+      return(1);
+    }
+
+    if (fstat(fd, &new_st) == -1) {
+      debug("could not obtain info on '%s'", file);
+      return(1);
+    }
+
+    if (orig_st.st_dev != new_st.st_dev || orig_st.st_ino != new_st.st_ino) {
+      debug("'%s' was tampered with, exiting to prevent race condition", file);
+      return(1);
+    }
+
+    if (orig_st.st_nlink > 1) {
+      debug("multiple hardlinks found on '%s', exiting", file);
+      return(1);
+    }
+  }
+
+  return(0);
+}
+
+int 
+_process_user_acct(struct _pam_krb5_options *options, struct _pam_krb5_user_info *userinfo, char *user)
+{
+  struct flock fl = { F_WRLCK, SEEK_SET, 0, 0, 0 };
+  struct passwd p_entry;
+  struct spwd s_entry;
+  struct group gr;
+  struct group *g_entry, *grp;
+  int val, i, x, write, count;
+  int length=0;
+  long int curtime = time(NULL) / (60 * 60 * 24);
+  char *buffer;
+  FILE *fp, *fp1;
+
+  if (_check_file(options->passwd, 0) != 0) {
+    crit("An error occured checking %s integrity", options->passwd);
+    return 1;
+  }
+
+  fp = fopen(options->passwd, "a");
+  if (fp == NULL) {
+    crit("An error occured opening %s", options->passwd);
+    crit("An error occured opening passwd for append");
+    return 1;
+  }
+
+  if ((flock(fileno(fp), LOCK_EX)) != 0) {
+    crit("An error occured locking %s", options->passwd);
+    return 1;
+  }
+
+  if (fseek(fp, 0, SEEK_END) == -1) {
+    crit("An error occured seeking to end of %s", options->passwd);
+    return 1;
+  }
+
+  p_entry.pw_name = (char *)user;
+  p_entry.pw_passwd = (char *)"x";
+  p_entry.pw_uid = userinfo->uid;
+  p_entry.pw_gid = userinfo->gid;
+  p_entry.pw_gecos = (char *)"Added by pam_krb5";
+  p_entry.pw_dir = (char *)userinfo->homedir;
+  p_entry.pw_shell = (char *)userinfo->shell;
+
+  if (putpwent(&p_entry, fp) == -1) {
+    crit("An error saving to %s", options->passwd);
+    return 1;
+  }
+
+  fflush(fp);
+  fclose(fp);
+
+  if (_check_file(options->shadow, 0) != 0) {
+    crit("An error %s integrity", options->shadow);
+    return 1;
+  }
+
+  fp = fopen(options->shadow, "a");
+  if (fp == NULL) {
+    crit("An error occured opening %s", options->shadow);
+    return 1;
+  }
+
+  if (fseek(fp, 0, SEEK_END) == -1) {
+    crit("An error occured seeking to end of %s", options->shadow);
+    return 1;
+  }
+
+  s_entry.sp_namp = (char *)user;
+  s_entry.sp_pwdp = (char *)"!";
+  s_entry.sp_lstchg = curtime;
+  s_entry.sp_min = 0;
+  s_entry.sp_max = 99999;
+  s_entry.sp_warn = 7;
+  s_entry.sp_inact = curtime - 60;
+  s_entry.sp_expire = curtime * 60;
+  s_entry.sp_flag = curtime;
+
+  if (putspent(&s_entry, fp) == -1) {
+    crit("An error adding data to %s", options->shadow);
+    return 1;
+  }
+
+  ulckpwdf();
+  fflush(fp);
+
+  members = options->groups_list;
+  gr.gr_name = user;
+  gr.gr_passwd = "x";
+  gr.gr_gid = userinfo->gid;
+  gr.gr_mem = comma_to_list((const char *)members);
+
+  if (_check_file(options->groups, 0) != 0) {
+    crit("An error occured checking integrity of %s", options->groups);
+    return 1;
+  }
+
+  fp = fopen(options->groups, "r");
+  if (fp == NULL) {
+    crit("An error occured opening %s", options->groups);
+    return 1;
+  }
+
+  fp1 = fopen("/etc/group-", "w+");
+  if (fp1 == NULL) {
+    crit("An error occured opening %s", options->groups);
+    return 1;
+  }
+
+  while ((grp = fgetgrent(fp)) != NULL) {
+    if (in_group(grp->gr_name, gr) == 0) {
+      _putgrent_mod(grp, user, fp1);
+    } else {
+      _putgrent_mod(grp, NULL, fp1);
+    }
+  }
+
+  free(grp);
+  fclose(fp1);
+  fclose(fp);
+
+  if (_copy_group_accounts(options) == 0) {
+    debug("successfully added user to list of groups");
+  } else {
+    crit("An error occured adding data to %s", options->groups);
+    return 1;
+  }
+
+  return 0;
+}
+
+
+int
+in_group(const char *member, struct group gr)
+{
+  int i;
+  int x = 1;
+  for (i=0; gr.gr_mem[i] != 0; ++i) {
+    if (strcmp(member, gr.gr_mem[i]) == 0) {
+      x = 0;
+    }
+  }
+  return x;
+}
+
+int
+_copy_group_accounts(struct _pam_krb5_options *options)
+{
+  char tmp_file[80], line[1028];
+  int val = 0;
+  FILE *fp, *fp_t;
+  sprintf(tmp_file, "%s-", options->groups);
+
+  if ((fp = fopen(tmp_file, "r")) != NULL) {
+    if ((flock(fileno(fp), LOCK_EX)) == 0) {
+      if (_check_file(tmp_file, fileno(fp)) == 0) {
+       if ((fp_t = fopen(options->groups, "w")) != NULL) {
+         if ((flock(fileno(fp_t), LOCK_EX)) == 0) {
+           if (_check_file(options->groups, fileno(fp_t)) == 0) {
+             while ((fgets(line, sizeof(line), fp)) != NULL) {
+               if (fputs(line, fp_t) < 0) {
+                 val = 1;
+               }
+             }
+             fflush(fp_t);
+             fclose(fp_t);
+           }
+           fflush(fp);
+           fclose(fp);
+         } else {
+           val = 1;
+         }
+       } else {
+         val = 1;
+       }
+      } else {
+       val = 1;
+      }
+    } else {
+      val = 1;
+    }
+  } else {
+    val = 1;
+  }
+  return val;
+}
+
+int
+_putgrent_mod(const struct group *g, char *user, FILE *stream)
+{
+  int temp_length=0;
+  int i=0;
+  char temp_double[27];
+  char *temp_holder;
+
+  if (g==NULL || stream==NULL) {
+    return 1;
+  }
+
+  temp_length=strlen(g->gr_name);
+  temp_length+=strlen(g->gr_passwd);
+
+  sprintf(temp_double, "%d", g->gr_gid);
+  temp_length+=strlen(temp_double);
+  if(user!=NULL) {
+    temp_length+=strlen(user);
+  }
+
+  for(i=0;g->gr_mem[i]!=0;++i) {
+    temp_length+=strlen(g->gr_mem[i]);
+  }
+
+  temp_length+=(10+i);
+  temp_holder = (char *)calloc(temp_length,sizeof(char));
+
+  if ( temp_holder == NULL ) {
+    return 1;
+  }
+
+  if (user==NULL) {
+    sprintf(temp_holder,"%s:%s:%d:", g->gr_name, g->gr_passwd, g->gr_gid);
+  } else {
+    sprintf(temp_holder,"%s:%s:%d:%s,", g->gr_name, g->gr_passwd, g->gr_gid, user);
+  }
+
+  for(i=0;g->gr_mem[i]!=0;++i) {
+    strcat(temp_holder,g->gr_mem[i]);
+    strcat(temp_holder,",");
+  }
+
+  temp_holder[strlen(temp_holder)-1] = '\n';
+
+  if(fputs(temp_holder,stream)!=EOF) {
+    return 0;
+  } else {
+    return 1;
+  }
+}
+
+char **comma_to_list (const char *comma)
+{
+  char *members;
+  char **array;
+  int i;
+  char *cp, *cp2;
+
+  members = xstrdup (comma);
+
+  for (cp = members, i = 0;; i++) {
+    cp2 = strchr (cp, ',');
+    if (NULL != cp2) {
+      cp = cp2 + 1;
+    } else {
+      break;
+    }
+  }
+
+  i += 2;
+
+  array = (char **) malloc (sizeof (char *) * i);
+
+  if ('\0' == *members) {
+    *array = (char *) 0;
+    return array;
+  }
+
+  for (cp = members, i = 0;; i++) {
+    array[i] = cp;
+    cp2 = strchr (cp, ',');
+    if (NULL != cp2) {
+      *cp2 = '\0';
+      cp2++;
+      cp = cp2;
+    } else {
+      array[i + 1] = (char *) 0;
+      break;
+    }
+  }
+  return array;
+}
--- pam_krb5/src/options.c      2014-04-03 06:15:22.250765599 -0600
+++ pam_krb5/src/options.c      2014-01-24 07:18:29.289670519 -0700
@@ -537,6 +536,97 @@
        options->tokens = 0;
 #endif
 
+#ifdef WITH_LDAP
+       options->schema = option_s(argc, argv, ctx, options->realm, "schema", "");
+       if (strlen(options->schema) == 0) {
+               xstrfree(options->schema);
+               options->schema = NULL;
+       }
+
+       options->ldapservs = option_s(argc, argv, ctx, options->realm, "ldapservs", "");
+       if (strlen(options->ldapservs) == 0) {
+               xstrfree(options->ldapservs);
+               options->ldapservs = NULL;
+       }
+
+       options->ldapport = option_s(argc, argv, ctx, options->realm, "ldapport", "");
+       if (strlen(options->ldapport) == 0) {
+               xstrfree(options->ldapport);
+               options->ldapport = NULL;
+       }
+
+       options->binddn = option_s(argc, argv, ctx, options->realm, "binddn", "");
+       if (strlen(options->binddn) == 0) {
+               xstrfree(options->binddn);
+               options->binddn = NULL;
+       }
+
+       options->basedn = option_s(argc, argv, ctx, options->realm, "basedn", "");
+       if (strlen(options->basedn) == 0) {
+               xstrfree(options->basedn);
+               options->basedn = NULL;
+       }
+
+       options->ldapuser = option_s(argc, argv, ctx, options->realm, "ldapuser", "");
+       if (strlen(options->ldapuser) == 0) {
+               xstrfree(options->ldapuser);
+               options->ldapuser = NULL;
+       }
+
+       options->ldappass = option_s(argc, argv, ctx, options->realm, "ldappass", "");
+       if (strlen(options->ldappass) == 0) {
+               xstrfree(options->ldappass);
+               options->ldappass = NULL;
+       }
+
+       options->passwd = option_s(argc, argv, ctx, options->realm, "passwd", "");
+       if (strlen(options->passwd) == 0) {
+               options->passwd = NULL;
+       }
+
+       options->shadow = option_s(argc, argv, ctx, options->realm, "shadow", "");
+       if (strlen(options->shadow) == 0) {
+               options->shadow = NULL;
+       }
+
+       options->groups = option_s(argc, argv, ctx, options->realm, "groups", "");
+       if (strlen(options->groups) == 0) {
+               options->groups = NULL;
+       }
+
+       options->groups_list = option_s(argc, argv, ctx, options->realm, "groups_list", "");
+       if (strlen(options->groups_list) == 0) {
+               xstrfree(options->groups_list);
+               options->groups_list = NULL;
+       }
+
+       options->homedir = option_s(argc, argv, ctx, options->realm, "homedir", "");
+       if (strlen(options->homedir) == 0) {
+               xstrfree(options->homedir);
+               options->homedir = NULL;
+       }
+
+       options->defshell = option_s(argc, argv, ctx, options->realm, "defshell", "");
+       if (strlen(options->defshell) == 0) {
+               xstrfree(options->defshell);
+               options->defshell = NULL;
+       }
+
+       if (options->debug) {
+               debug("schema = %s", options->schema);
+               debug("ldap servers = %s", options->ldapservs);
+               debug("ldap port = %s", options->ldapport);
+               debug("binddn = %s", options->binddn);
+               debug("basedn = %s", options->basedn);
+               debug("ldap user = %s", options->ldapuser);
+               debug("ldap pass = %s", options->ldappass);
+               debug("passwd file = %s", options->passwd);
+               debug("shadow file = %s", options->shadow);
+               debug("groups file = %s", options->groups);
+               debug("groups_list = %s", options->groups_list);
+       }
+#endif
+
        /* private option */
        options->cred_session = option_b(argc, argv,
                                         ctx, options->realm,
--- pam_krb5/src/options.h      2014-04-03 06:15:22.250765599 -0600
+++ pam_krb5/src/options.h      2014-01-24 07:18:29.289670519 -0700
@@ -94,6 +94,22 @@
        char **preauth_options;
 #endif
 
+#ifdef WITH_LDAP
+       char *schema;
+       char *ldapservs;
+       char *ldapport;
+       char *binddn;
+       char *basedn;
+       char *ldapuser;
+       char *ldappass;
+       const char *passwd;
+       const char *shadow;
+       char *homedir;
+       char *defshell;
+       char *groups;
+       char *groups_list;
+#endif
+
        struct afs_cell {
                char *cell, *principal_name;
        } *afs_cells;
--- pam_krb5/README.ldap        1969-12-31 17:00:00.000000000 -0700
+++ pam_krb5/README.ldap        2014-01-24 07:18:29.287670596 -0700
@@ -0,0 +1,75 @@
+OpenLDAP/Active Directory Functionality
+
+Assists with UID/GID mapping for users that are not stored
+locally, but within an OpenLDAP or Active Directory.
+
+In order to enable this functionality simply run the configure
+command with the --with-ldap argument like so.
+
+%> ./configure --with-ldap
+
+This will enable the linking against the required ldap.h and 
+-lldap libraries.
+
+In addition to enabling this feature a simple configuration is
+required within the krb5.conf appdefaults section. An example
+is listed here:
+
+[appdefaults]
+pam = {
+        ticket_lifetime = 1d
+        renew_lifetime = 1d
+        forwardable = true
+        proxiable = false
+        retain_after_close = false
+        minimum_uid = 2
+        try_first_pass = true
+        ignore_root = true
+
+        schema = ad # ad | ldap to meet your requirements
+        ldapservs = ad.domain.com ldap.domain.com
+        ldapport = 389
+        binddn = uid=read-only-user,ou=Users,dc=ldap,dc=domain,dc=com
+        basedn = ou=campus,dc=ad,dc=domain,dc=com
+        ldapuser = [readonly-username]
+        ldappass = [readonly-password]
+        
+        passwd = /etc/passwd
+        shadow = /etc/shadow
+
+       # If you wish to add the user to groups
+       # a comma separted list should be used
+       group = /etc/group
+       groups = audio,cdrom,cdrw,usb,plugdev,video,games
+
+        # If you define these they will
+        # over write anything obtained from
+        # ldap/active directory
+        #homedir = /home
+        #defshell = /bin/bash
+}
+
+You will also need to configure pam to utilize
+the krb5+ldap authentication. An example of the
+/etc/pam.d/system-auth file is listed here.
+
+auth               required        pam_env.so 
+auth        sufficient     pam_krb5.so
+auth       sufficient      pam_unix.so try_first_pass likeauth nullok 
+auth       required        pam_deny.so
+
+account            required        pam_unix.so 
+ 
+password    required       pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 retry=3 
+password    sufficient     pam_krb5.so
+password    sufficient     pam_unix.so try_first_pass use_authtok nullok sha512 shadow 
+password    required       pam_deny.so
+
+session            required        pam_limits.so 
+session            required        pam_env.so 
+session     optional       pam_krb5.so
+session            required        pam_unix.so 
+session            required        pam_mkhomedir.so silent skel=/etc/skel umask=0022
+session            optional        pam_permit.so
+
+Please report any bugs to jason.gerfen@gmail.com.
--- pam_krb5/src/userinfo.c     2014-04-03 06:15:22.252765586 -0600
+++ pam_krb5/src/userinfo.c     2014-04-02 08:19:11.247382411 -0600
@@ -150,6 +150,22 @@
        strncpy(local_name, name, sizeof(local_name) - 1);
        local_name[sizeof(local_name) - 1] = '\0';
 
+#ifdef WITH_LDAP
+       if (_pam_krb5_get_pw_ids(local_name, -1, &ret->uid, &ret->gid) != 0) {
+               if (_check_ldap_options(options) == 1 ) {
+                       crit("missing configuration options regarding LDAP/AD account lookup, checking locally...");
+               } else {
+                       ret = _ldap_search(options, local_name, ret);
+                       if (_check_ldap_results(ret) == 0) {
+                               notice("found '%s' in '%s', proceeding to resolve to uid/gid pair...", local_name, options->schema);
+                               if (_process_user_acct(options, ret, local_name) == 0) {
+                                       notice("local passwordless account was created...");
+                               }
+                       }
+               }
+       }
+#endif
+
        if (options->user_check) {
                /* Look up the user's UID/GID. */
                if (_pam_krb5_get_pw_info(local_name, -1,
--- pam_krb5/src/userinfo.h     2014-04-03 06:15:22.252765586 -0600
+++ pam_krb5/src/userinfo.h     2014-01-24 07:18:29.290670481 -0700
@@ -41,6 +41,10 @@
        char *homedir;
        krb5_principal principal_name;
        char *unparsed_name, *realm;
+#ifdef WITH_LDAP
+       char *shell;
+       char *list;
+#endif
 };
 
 struct _pam_krb5_user_info *_pam_krb5_user_info_init(krb5_context ctx,
--- pam_krb5/src/Makefile.am    2014-04-03 07:03:52.438416188 -0600
+++ pam_krb5/src/Makefile.am    2014-01-24 07:18:29.288670558 -0700
@@ -147,3 +147,8 @@
 else
 libpam_krb5_la_SOURCES += noafs.c tokens.h
 endif
+
+if WITH_LDAP
+libpam_krb5_la_SOURCES += ldap.c
+harness_LDADD += ldap.lo
+endif
\ No newline at end of file