16470: Avoids crashing when running the rake task db:create.

[arvados.git] / lib / pam / pam_arvados.go

diff --git a/lib/pam/pam_arvados.go b/lib/pam/pam_arvados.go
index 48e0f50485d11bd64923112ce3ccb7bcfe267bba..34b90805363fc3230ef7f78f1bf3605ecebdfdea 100644 (file)
--- a/lib/pam/pam_arvados.go
+++ b/lib/pam/pam_arvados.go
@@ -24,6 +24,7 @@ package main
 import (
        "io/ioutil"
        "log/syslog"
+       "os"
 
        "context"
        "errors"
@@ -55,6 +56,11 @@ func init() {
        }
 }
 
+//export pam_sm_setcred
+func pam_sm_setcred(pamh *C.pam_handle_t, flags, cArgc C.int, cArgv **C.char) C.int {
+       return C.PAM_IGNORE
+}
+
 //export pam_sm_authenticate
 func pam_sm_authenticate(pamh *C.pam_handle_t, flags, cArgc C.int, cArgv **C.char) C.int {
        runtime.GOMAXPROCS(1)
@@ -99,8 +105,16 @@ func authenticate(logger *logrus.Logger, username, token string, argv []string)
                        logger.Warnf("unkown option: %s\n", arg)
                }
        }
+       if hostname == "" || hostname == "-" {
+               h, err := os.Hostname()
+               if err != nil {
+                       logger.WithError(err).Warnf("cannot get hostname -- try using an explicit hostname in pam config")
+                       return fmt.Errorf("cannot get hostname: %w", err)
+               }
+               hostname = h
+       }
        logger.Debugf("username=%q arvados_api_host=%q hostname=%q insecure=%t", username, apiHost, hostname, insecure)
-       if apiHost == "" || hostname == "" {
+       if apiHost == "" {
                logger.Warnf("cannot authenticate: config error: arvados_api_host and hostname must be non-empty")
                return errors.New("config error")
        }
@@ -123,7 +137,11 @@ func authenticate(logger *logrus.Logger, username, token string, argv []string)
                return err
        }
        if len(vms.Items) == 0 {
-               return fmt.Errorf("no results for hostname %q", hostname)
+               // It's possible there is no VM entry for the
+               // configured hostname, but typically this just means
+               // the user does not have permission to see (let alone
+               // log in to) this VM.
+               return errors.New("permission denied")
        } else if len(vms.Items) > 1 {
                return fmt.Errorf("multiple results for hostname %q", hostname)
        } else if vms.Items[0].Hostname != hostname {