Question

我的程序必须对人员进行身份验证，运行它的当前计算机通过ldap服务器识别用户。

我在一台简单的计算机上成功测试了这段代码：

#include <stdlib.h>
#include <iostream>
#include <fstream>
#include <security/pam_appl.h>
#include <unistd.h>

// To build this:
// g++ pam.cc -lpam -o test

struct pam_response *reply;

//function used to get user input
int function_conversation(int num_msg, const struct pam_message **msg, struct pam_response **resp, void *appdata_ptr)
{
    *resp = reply;
    return PAM_SUCCESS;
}

int main(int argc, char** argv)
{
    if(argc != 2) {
        fprintf(stderr, "Usage: check_user <username>\n");
        exit(1);
    }
    const char *username;
    username = argv[1];

    const struct pam_conv local_conversation = { function_conversation, NULL };
  pam_handle_t *local_auth_handle = NULL; // this gets set by pam_start

  int retval;

  // local_auth_handle gets set based on the service
  retval = pam_start("common-auth", username, &local_conversation, &local_auth_handle);

  if (retval != PAM_SUCCESS)
  {
    std::cout << "pam_start returned " << retval << std::endl;
    exit(retval);
  }

  reply = (struct pam_response *)malloc(sizeof(struct pam_response));

  // *** Get the password by any method, or maybe it was passed into this function.
  reply[0].resp = getpass("Password: ");
  reply[0].resp_retcode = 0;

  retval = pam_authenticate(local_auth_handle, 0);

  if (retval != PAM_SUCCESS)
  {
    if (retval == PAM_AUTH_ERR)
    {
        std::cout << "Authentication failure." << std::endl;
    }
    else
    {
        std::cout << "pam_authenticate returned " << retval << std::endl;
    }
    exit(retval);
  }

  std::cout << "Authenticated." << std::endl;

  retval = pam_end(local_auth_handle, retval);

  if (retval != PAM_SUCCESS)
  {
    std::cout << "pam_end returned " << retval << std::endl;
    exit(retval);
  }

  return retval;
}

但它不适用于ldap。它只会说“认证失败”因此我试过这个想法ldap就是问题：

#include <stdio.h>
#include <ldap.h>
/* LDAP Server settings */
#define LDAP_SERVER "ldap://annuaire.upmc.fr:389"

int
main( int argc, char **argv )
{
    LDAP        *ld;
    int        rc;
    char        bind_dn[100];

/* Get username and password */
    if( argc != 3 )
    {
        perror( "invalid args, required: username password" );
        return( 1 );
    }
    sprintf( bind_dn, "uid=%s,ou=people,dc=upmc,dc=fr", argv[1] );
    printf( "Connecting as %s...\n", bind_dn );

/* Open LDAP Connection */
    if( ldap_initialize( &ld, LDAP_SERVER ) )
    {
        perror( "ldap_initialize" );
        return( 1 );
    }


/* User authentication (bind) */
    rc = ldap_simple_bind_s( ld, bind_dn, argv[2] );
    if( rc != LDAP_SUCCESS )
    {
        fprintf(stderr, "ldap_simple_bind_s: %s\n", ldap_err2string(rc) );
        return( 1 );
    }
    printf( "Successful authentication\n" );
    ldap_unbind( ld );
    return( 0 );
}

但是我在尝试登录时遇到此错误：

ldap_simple_bind_s: Invalid credentials.

看起来服务器已找到但无法验证我。

我的问题是：pam和ldap有什么区别，pam是一种更普遍的认证方式吗？我可以使用pam程序实现ldap的身份验证，或者我的ldap测试代码没有问题吗？

使用ldap或pam通过C ++程序验证用户身份

0 个答案: