From b42307d16989815ede41ced49f7c3d7b0c5cd0ed Mon Sep 17 00:00:00 2001
From: Remi Mollon <remi.mollon@cern.ch>
Date: Wed, 18 Jan 2012 17:04:58 +0100
Subject: [PATCH] adding yubi_prefix parameter, when looking for token_id in
 ldap

---
 pam_yubico.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pam_yubico.c b/pam_yubico.c
index 20546fb..e0deb43 100644
--- a/pam_yubico.c
+++ b/pam_yubico.c
@@ -109,6 +109,7 @@ struct cfg
   char *ldapdn;
   char *user_attr;
   char *yubi_attr;
+  char *yubi_prefix;
   int token_id_length;
   enum key_mode mode;
   char *chalresp_path;
@@ -278,6 +279,7 @@ authorize_user_token_ldap (struct cfg *cfg,
   int retval = 0;
   int protocol;
 #ifdef HAVE_LIBLDAP
+  int yubi_prefix_len = 0;
   LDAP *ld = NULL;
   LDAPMessage *result = NULL, *e;
   BerElement *ber;
@@ -374,17 +376,22 @@ authorize_user_token_ldap (struct cfg *cfg,
 	{
 	  if ((vals = ldap_get_values_len (ld, e, a)) != NULL)
 	    {
+	      yubi_prefix_len = cfg->yubi_prefix ? strlen(cfg->yubi_prefix) : 0;
+
 	      /* Compare each value for the attribute against the token id. */
 	      for (i = 0; vals[i] != NULL; i++)
 		{
-		  if (!strncmp (token_id, vals[i]->bv_val, strlen (token_id)))
+		  if ((!cfg->yubi_prefix || !strncmp (cfg->yubi_prefix, vals[i]->bv_val, yubi_prefix_len)))
 		    {
-		      DBG (("Token Found :: %s", vals[i]->bv_val));
-		      retval = 1;
-		    }
-		  else
-		    {
-		      DBG (("No match : (%s) %s != %s", a, vals[i]->bv_val, token_id));
+		      if(!strncmp (token_id, vals[i]->bv_val + yubi_prefix_len, strlen (token_id)))
+		        {
+		          DBG (("Token Found :: %s", vals[i]->bv_val + yubi_prefix_len));
+		          retval = 1;
+		        }
+		      else
+		        {
+		          DBG (("No match : (%s) %s != %s", a, vals[i]->bv_val + yubi_prefix_len, token_id));
+		        }
 		    }
 		}
 	      ldap_value_free_len (vals);
@@ -692,6 +699,8 @@ parse_cfg (int flags, int argc, const char **argv, struct cfg *cfg)
 	cfg->user_attr = (char *) argv[i] + 10;
       if (strncmp (argv[i], "yubi_attr=", 10) == 0)
 	cfg->yubi_attr = (char *) argv[i] + 10;
+      if (strncmp (argv[i], "yubi_prefix=", 12) == 0)
+	cfg->yubi_prefix = (char *) argv[i] + 12;
       if (strncmp (argv[i], "token_id_length=", 16) == 0)
 	sscanf (argv[i], "token_id_length=%d", &cfg->token_id_length);
       if (strcmp (argv[i], "mode=challenge-response") == 0)
@@ -721,6 +730,7 @@ parse_cfg (int flags, int argc, const char **argv, struct cfg *cfg)
       D (("ldapdn=%s", cfg->ldapdn ? cfg->ldapdn : "(null)"));
       D (("user_attr=%s", cfg->user_attr ? cfg->user_attr : "(null)"));
       D (("yubi_attr=%s", cfg->yubi_attr ? cfg->yubi_attr : "(null)"));
+      D (("yubi_prefix=%s", cfg->yubi_prefix ? cfg->yubi_prefix : "(null)"));
       D (("url=%s", cfg->url ? cfg->url : "(null)"));
       D (("capath=%s", cfg->capath ? cfg->capath : "(null)"));
       D (("token_id_length=%d", cfg->token_id_length));