jeroennijhof/pam_tacplus — pull request #8 by walterdejong (2014-02-19 13:23:49+00:00)
Title: bugfix: do not consult other servers when AUTHEN_STATUS_FAIL

`pam_sm_authenticate()` has a loop that continues to try other servers even when a tacplus server has responded with `AUTHEN_STATUS_FAIL`, meaning that the authentication failed due to incorrect password (or perhaps user unknown).
This is a bug because it keeps trying slave servers, and the underlying directory server will _disable_ logins after xxx attempts. The result is that people get locked out after a single typo.

This pull request fixes this bug.

If the behavior was intended -- ie. a trick to find a working login across multiple servers -- I suggest that you still accept this pull request and add a new option `tryallservers` or something like that, and document in the README exactly what the implications of this option are.

About the code; I replaced the deeply nested if-else structure with a switch/case. The code is so big it should probably be put into a helper function, but there are so many variables at play that I didn't bother trying.
The other stuff is just code cleanups, notably a double loop in `_pam_account()`.

Greets,

--Walter & Jurriaan (who found and described the problem)