diff options
| -rw-r--r-- | src/backend/libpq/auth.c | 26 |
1 files changed, 17 insertions, 9 deletions
diff --git a/src/backend/libpq/auth.c b/src/backend/libpq/auth.c index d28271c1d87..5bc42a67264 100644 --- a/src/backend/libpq/auth.c +++ b/src/backend/libpq/auth.c @@ -110,6 +110,7 @@ static const char *pam_passwd = NULL; /* Workaround for Solaris 2.6 * brokenness */ static Port *pam_port_cludge; /* Workaround for passing "Port *port" into * pam_passwd_conv_proc */ +static bool pam_no_password; /* For detecting no-password-given */ #endif /* USE_PAM */ @@ -2099,8 +2100,10 @@ pam_passwd_conv_proc(int num_msg, const struct pam_message **msg, { /* * Client didn't want to send password. We - * intentionally do not log anything about this. + * intentionally do not log anything about this, + * either here or at higher levels. */ + pam_no_password = true; goto fail; } } @@ -2159,6 +2162,7 @@ CheckPAMAuth(Port *port, const char *user, const char *password) */ pam_passwd = password; pam_port_cludge = port; + pam_no_password = false; /* * Set the application data portion of the conversation struct. This is @@ -2244,22 +2248,26 @@ CheckPAMAuth(Port *port, const char *user, const char *password) if (retval != PAM_SUCCESS) { - ereport(LOG, - (errmsg("pam_authenticate failed: %s", - pam_strerror(pamh, retval)))); + /* If pam_passwd_conv_proc saw EOF, don't log anything */ + if (!pam_no_password) + ereport(LOG, + (errmsg("pam_authenticate failed: %s", + pam_strerror(pamh, retval)))); pam_passwd = NULL; /* Unset pam_passwd */ - return STATUS_ERROR; + return pam_no_password ? STATUS_EOF : STATUS_ERROR; } retval = pam_acct_mgmt(pamh, 0); if (retval != PAM_SUCCESS) { - ereport(LOG, - (errmsg("pam_acct_mgmt failed: %s", - pam_strerror(pamh, retval)))); + /* If pam_passwd_conv_proc saw EOF, don't log anything */ + if (!pam_no_password) + ereport(LOG, + (errmsg("pam_acct_mgmt failed: %s", + pam_strerror(pamh, retval)))); pam_passwd = NULL; /* Unset pam_passwd */ - return STATUS_ERROR; + return pam_no_password ? STATUS_EOF : STATUS_ERROR; } retval = pam_end(pamh, retval); |