Drastic impromvents to pam_winbind.

This adds code to do generic PAM -> NTSTATUS and NTSTATUS -> PAM error
conversions, and uses them to make the error handling in pam_winbind sane.

In particular, pam_winbind now uses PAM error codes, not silly '-1, -2 ...'
stuff, and logs the NTSTATUS error that winbind now sends over the pipe.

Added code to wbinfo to display these - makes a big difference in debugging
winbindd.

The main change here is the code to allow pam_winbind password changing to
correctly stack - This code ripped from pam_unix, and the copyright attached.
(Same as for all pam modules, including pam_winbind)

Andrew Bartlett
(This used to be commit dc1a72f896b83bc1ad3c7bf6c12c36ace3967280)

1 files changed, 6 insertions, 0 deletions

diff --git a/source3/nsswitch/wbinfo.c b/source3/nsswitch/wbinfo.c
index 32a3c95113..93c73f6095 100644
--- a/source3/nsswitch/wbinfo.c
+++ b/source3/nsswitch/wbinfo.c
@@ -389,6 +389,8 @@ static BOOL wbinfo_auth(char *username)
         printf("plaintext password authentication %s\n", 
                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 
+	printf("error code was %s (HEX: %x)\n", response.data.auth.nt_status_string, response.data.auth.nt_status);
+
         return result == NSS_STATUS_SUCCESS;
 }
 
@@ -439,6 +441,10 @@ static BOOL wbinfo_auth_crap(char *username)
         printf("challenge/response password authentication %s\n", 
                (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
 
+	printf("error code was %s (HEX: %x)\n", 
+	       response.data.auth.nt_status_string, 
+	       response.data.auth.nt_status);
+
         return result == NSS_STATUS_SUCCESS;
 }