From 6d485cdb11d3c2b8855a6380f759ae2df6e5c35b Mon Sep 17 00:00:00 2001
From: Jan Zeleny <jzeleny@redhat.com>
Date: Apr 24 2012 13:19:43 +0000
Subject: Basic support for subdomains in auth provider


---

diff --git a/src/providers/data_provider_be.c b/src/providers/data_provider_be.c
index 101bd3b..f550c4e 100644
--- a/src/providers/data_provider_be.c
+++ b/src/providers/data_provider_be.c
@@ -813,10 +813,12 @@ static int be_pam_handler(DBusMessage *message, struct sbus_connection *conn)
     }
 
     pd->pam_status = PAM_SYSTEM_ERR;
-    pd->domain = talloc_strdup(pd, becli->bectx->domain->name);
     if (pd->domain == NULL) {
-        talloc_free(be_req);
-        return ENOMEM;
+        pd->domain = talloc_strdup(pd, becli->bectx->domain->name);
+        if (pd->domain == NULL) {
+            talloc_free(be_req);
+            return ENOMEM;
+        }
     }
 
 
diff --git a/src/providers/dp_auth_util.c b/src/providers/dp_auth_util.c
index 7c3541b..9a67564 100644
--- a/src/providers/dp_auth_util.c
+++ b/src/providers/dp_auth_util.c
@@ -35,6 +35,7 @@ bool dp_pack_pam_request(DBusMessage *msg, struct pam_data *pd)
     db_ret = dbus_message_append_args(msg,
                                       DBUS_TYPE_INT32,  &(pd->cmd),
                                       DBUS_TYPE_STRING, &(pd->user),
+                                      DBUS_TYPE_STRING, &(pd->domain),
                                       DBUS_TYPE_STRING, &(pd->service),
                                       DBUS_TYPE_STRING, &(pd->tty),
                                       DBUS_TYPE_STRING, &(pd->ruser),
@@ -66,6 +67,7 @@ bool dp_unpack_pam_request(DBusMessage *msg, TALLOC_CTX *mem_ctx,
     db_ret = dbus_message_get_args(msg, dbus_error,
                                    DBUS_TYPE_INT32,  &(pd.cmd),
                                    DBUS_TYPE_STRING, &(pd.user),
+                                   DBUS_TYPE_STRING, &(pd.domain),
                                    DBUS_TYPE_STRING, &(pd.service),
                                    DBUS_TYPE_STRING, &(pd.tty),
                                    DBUS_TYPE_STRING, &(pd.ruser),
diff --git a/src/providers/ipa/ipa_auth.c b/src/providers/ipa/ipa_auth.c
index eb62f02..2bd313b 100644
--- a/src/providers/ipa/ipa_auth.c
+++ b/src/providers/ipa/ipa_auth.c
@@ -210,6 +210,12 @@ void ipa_auth(struct be_req *be_req)
 
     state->pd = pd;
 
+    if (strcasecmp(pd->domain, be_req->be_ctx->domain->name) != 0 &&
+        state->pd->cmd != SSS_PAM_ACCT_MGMT) {
+        DEBUG(SSSDBG_OP_FAILURE, ("This operation is not allowed for subdomains!\n"));
+        goto fail;
+    }
+
     switch (state->pd->cmd) {
         case SSS_PAM_AUTHENTICATE:
             state->ipa_auth_ctx = talloc_get_type(