+static void cmd_passwd_auth_fake(struct client *c, const char *passwd)
+{
+ auth_check_token(auth_fake_token, passwd);
+ cmd_error(c, "Invalid password");
+}
+
+static struct auth_acct *cmd_need_passwd_auth_acct(struct client *c, const char *passwd)
+{
+ struct auth_zone *az = cmd_need_zone(c);
+ const char *login = cmd_need_string(c, "login");
+ if (!az->allow_passwd_auth || !az->allow_passwd)
+ {
+ msg(L_INFO, "Password authentication denied by zone configuration: login=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ cmd_error(c, "This zone does not allow password authentication for management");
+ }
+
+ struct auth_user *au = auth_find_user(login, 0);
+ if (!au)
+ {
+ msg(L_INFO, "Password authentication failed: No user=<%s> uid=<%u>", login, c->uid);
+ cmd_passwd_auth_fake(c, passwd);
+ }
+
+ struct auth_acct *aa = auth_find_acct(au, az, 0);
+ if (!aa)
+ {
+ msg(L_INFO, "Password authentication failed: No account user=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ cmd_passwd_auth_fake(c, passwd);
+ }
+ if (!aa->allow_passwd_auth)
+ {
+ msg(L_INFO, "Password authentication failed: Not allowed by user=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ cmd_passwd_auth_fake(c, passwd);
+ }
+
+ struct auth_token *at = auth_find_token_passwd(aa);
+ if (!at)
+ {
+ msg(L_INFO, "Password authentication failed: No password user=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ cmd_passwd_auth_fake(c, passwd);
+ }
+
+ if (!auth_check_token(at, passwd))
+ {
+ msg(L_INFO, "Password authentication failed: Wrong password for user=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ cmd_error(c, "Invalid password");
+ }
+
+ msg(L_INFO, "Password authentication successful: user=<%s> zone=<%s> uid=<%u>", login, az->name, c->uid);
+ return aa;
+}
+