+ const Credential& newCredential = *it;
+
+ // @@@ we log the uid a process was running under when it created the authref, which is misleading in the case of loginwindow
+ if (newCredential->isValid()) {
+ Syslog::info("UID %u authenticated as user %s (UID %u) for right '%s'", auth.creatorUid(), newCredential->name().c_str(), newCredential->uid(), rightName);
+ rightAuthLogger.logSuccess(auth.creatorUid(), newCredential->uid(), newCredential->name().c_str());
+ } else {
+ // we can't be sure that the user actually exists so inhibit logging of uid
+ Syslog::error("UID %u failed to authenticate as user '%s' for right '%s'", auth.creatorUid(), newCredential->name().c_str(), rightName);
+ rightAuthLogger.logFailure(auth.creatorUid(), newCredential->name().c_str());
+ }
+
+ if (!newCredential->isValid())
+ {
+ reason = SecurityAgent::invalidPassphrase;
+ continue;
+ }
+
+ // verify that this credential authorizes right
+ status = evaluateUserCredentialForRight(auth, inRight, inRule, environmentToClient, now, newCredential, true, reason);
+
+ if (status == errAuthorizationSuccess)
+ {
+ if (auth.operatesAsLeastPrivileged()) {
+ Credential rightCredential(rightName, mShared);
+ credentials.erase(rightCredential); credentials.insert(rightCredential);
+ if (mShared)
+ credentials.insert(Credential(rightName, false));
+ }
+
+ // whack an equivalent credential, so it gets updated to a later achieved credential which must have been more stringent
+ credentials.erase(newCredential); credentials.insert(newCredential);
+ // just got a new credential - if it's shared also add a non-shared one that to stick in the authorizationref local cache
+ if (mShared)
+ credentials.insert(Credential(newCredential->uid(), newCredential->name(), newCredential->realname(), false));
+
+ // use valid credential to set context info
+ // XXX/cs keeping this for now, such that the uid is passed back
+ auth.setCredentialInfo(newCredential, savePassword);
+ secdebug("SSevalMech", "added valid credential for user %s", newCredential->name().c_str());
+ // set the sessionHasAuthenticated
+ if (newCredential->uid() == auth.session().originatorUid()) {
+ secdebug("AuthEvalMech", "We authenticated as the session owner.\n");
+ SessionAttributeBits flags = auth.session().attributes();
+ flags |= AU_SESSION_FLAG_HAS_AUTHENTICATED;
+ auth.session().setAttributes(flags);
+ }
+
+ status = errAuthorizationSuccess;
+ break;
+ }
projects / apple / securityd.git / blobdiff