Refactor things a little. Rename renew to refresh. Add a pid to the

2008-03-14  William Jon McCann  <jmccann@redhat.com>

	* daemon/gdm-manager.c: (bus_name_owner_changed):
	* daemon/gdm-product-slave.c: (send_dbus_string_method),
	(send_dbus_void_method), (send_dbus_int_method),
	(relay_session_started), (on_session_started),
	(on_relay_refresh_credentials), (relay_dbus_handle_message):
	* daemon/gdm-session-direct.c:
	(gdm_session_direct_handle_session_started), (do_introspect),
	(gdm_session_direct_accredit):
	* daemon/gdm-session-private.h:
	* daemon/gdm-session-relay.c: (gdm_session_relay_accredit),
	(handle_secret_info_query), (handle_info), (handle_problem),
	(handle_session_started), (do_introspect),
	(gdm_session_iface_init):
	* daemon/gdm-session-worker.c:
	(gdm_session_worker_update_environment_from_passwd_info),
	(_change_user), (_lookup_passwd_info),
	(gdm_session_worker_accredit_user), (on_refresh_credentials),
	(worker_dbus_handle_message):
	* daemon/gdm-session.c: (gdm_session_class_init),
	(_gdm_session_session_started):
	* daemon/gdm-session.h:
	* daemon/gdm-simple-slave.c: (on_session_started),
	(gdm_simple_slave_accredit_when_ready), (on_greeter_connected):
	* daemon/gdm-slave.c: (gdm_slave_get_primary_session_id_for_user),
	(gdm_slave_switch_to_user_session):
	* daemon/gdm-slave.h:
	Refactor things a little.  Rename renew to refresh.  Add a pid to the
	session started signal.


svn path=/trunk/; revision=6018

12 files changed, 295 insertions, 109 deletions

diff --git a/ChangeLog b/ChangeLog
index 5695f855..03005d5f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,34 @@
+2008-03-14  William Jon McCann  <jmccann@redhat.com>
+
+	* daemon/gdm-manager.c: (bus_name_owner_changed):
+	* daemon/gdm-product-slave.c: (send_dbus_string_method),
+	(send_dbus_void_method), (send_dbus_int_method),
+	(relay_session_started), (on_session_started),
+	(on_relay_refresh_credentials), (relay_dbus_handle_message):
+	* daemon/gdm-session-direct.c:
+	(gdm_session_direct_handle_session_started), (do_introspect),
+	(gdm_session_direct_accredit):
+	* daemon/gdm-session-private.h:
+	* daemon/gdm-session-relay.c: (gdm_session_relay_accredit),
+	(handle_secret_info_query), (handle_info), (handle_problem),
+	(handle_session_started), (do_introspect),
+	(gdm_session_iface_init):
+	* daemon/gdm-session-worker.c:
+	(gdm_session_worker_update_environment_from_passwd_info),
+	(_change_user), (_lookup_passwd_info),
+	(gdm_session_worker_accredit_user), (on_refresh_credentials),
+	(worker_dbus_handle_message):
+	* daemon/gdm-session.c: (gdm_session_class_init),
+	(_gdm_session_session_started):
+	* daemon/gdm-session.h:
+	* daemon/gdm-simple-slave.c: (on_session_started),
+	(gdm_simple_slave_accredit_when_ready), (on_greeter_connected):
+	* daemon/gdm-slave.c: (gdm_slave_get_primary_session_id_for_user),
+	(gdm_slave_switch_to_user_session):
+	* daemon/gdm-slave.h:
+	Refactor things a little.  Rename renew to refresh.  Add a pid to the
+	session started signal.
+
 2008-03-13  William Jon McCann  <jmccann@redhat.com>
 
 	* gui/simple-greeter/gdm-greeter-panel.c: (gdm_greeter_panel_init):
diff --git a/daemon/gdm-manager.c b/daemon/gdm-manager.c
index b0c2a642..cbd36dd9 100644
--- a/daemon/gdm-manager.c
+++ b/daemon/gdm-manager.c
@@ -225,9 +225,6 @@ bus_name_owner_changed (DBusGProxy  *bus_proxy,
         if (strlen (new_service_name) == 0) {
                 remove_displays_for_connection (manager, old_service_name);
         }
-
-        g_debug ("GdmManager: NameOwnerChanged: service_name='%s', old_service_name='%s' new_service_name='%s'",
-                   service_name, old_service_name, new_service_name);
 }
 
 static gboolean
diff --git a/daemon/gdm-product-slave.c b/daemon/gdm-product-slave.c
index fbde8fe2..60711c49 100644
--- a/daemon/gdm-product-slave.c
+++ b/daemon/gdm-product-slave.c
@@ -109,7 +109,7 @@ send_dbus_string_method (DBusConnection *connection,
                 str = "";
         }
 
-        g_debug ("GdmGreeterClient: Calling %s", method);
+        g_debug ("GdmProductSlave: Calling %s", method);
         message = dbus_message_new_method_call (NULL,
                                                 RELAY_SERVER_DBUS_PATH,
                                                 RELAY_SERVER_DBUS_INTERFACE,
@@ -155,7 +155,7 @@ send_dbus_void_method (DBusConnection *connection,
         DBusMessage    *message;
         DBusMessage    *reply;
 
-        g_debug ("GdmGreeterClient: Calling %s", method);
+        g_debug ("GdmProductSlave: Calling %s", method);
         message = dbus_message_new_method_call (NULL,
                                                 RELAY_SERVER_DBUS_PATH,
                                                 RELAY_SERVER_DBUS_INTERFACE,
@@ -188,11 +188,61 @@ send_dbus_void_method (DBusConnection *connection,
         return TRUE;
 }
 
+
+static gboolean
+send_dbus_int_method (DBusConnection *connection,
+                      const char     *method,
+                      int             payload)
+{
+        DBusError       error;
+        DBusMessage    *message;
+        DBusMessage    *reply;
+        DBusMessageIter iter;
+
+        g_debug ("GdmSessionWorker: Calling %s", method);
+        message = dbus_message_new_method_call (NULL,
+                                                RELAY_SERVER_DBUS_PATH,
+                                                RELAY_SERVER_DBUS_INTERFACE,
+                                                method);
+        if (message == NULL) {
+                g_warning ("Couldn't allocate the D-Bus message");
+                return FALSE;
+        }
+
+        dbus_message_iter_init_append (message, &iter);
+        dbus_message_iter_append_basic (&iter,
+                                        DBUS_TYPE_INT32,
+                                        &payload);
+
+        dbus_error_init (&error);
+        reply = dbus_connection_send_with_reply_and_block (connection,
+                                                           message,
+                                                           -1,
+                                                           &error);
+        dbus_message_unref (message);
+        if (reply != NULL) {
+                dbus_message_unref (reply);
+        }
+        dbus_connection_flush (connection);
+
+        if (dbus_error_is_set (&error)) {
+                g_debug ("%s %s raised: %s\n",
+                         method,
+                         error.name,
+                         error.message);
+                return FALSE;
+        }
+
+        return TRUE;
+}
+
 static void
-relay_session_started (GdmProductSlave *slave)
+relay_session_started (GdmProductSlave *slave,
+                       int              pid)
 {
-        send_dbus_void_method (slave->priv->session_relay_connection,
-                               "SessionStarted");
+        send_dbus_int_method (slave->priv->session_relay_connection,
+                              "SessionStarted",
+                              pid);
 }
 
 static void
@@ -222,11 +272,12 @@ disconnect_relay (GdmProductSlave *slave)
 
 static void
 on_session_started (GdmSession      *session,
+                    int              pid,
                     GdmProductSlave *slave)
 {
         g_debug ("GdmProductSlave: session started");
 
-        relay_session_started (slave);
+        relay_session_started (slave, pid);
 
         disconnect_relay (slave);
 }
@@ -629,12 +680,12 @@ on_relay_establish_credentials (GdmProductSlave *slave,
 }
 
 static void
-on_relay_renew_credentials (GdmProductSlave *slave,
-                            DBusMessage     *message)
+on_relay_refresh_credentials (GdmProductSlave *slave,
+                              DBusMessage     *message)
 {
-        g_debug ("GdmProductSlave: Relay RenewCredentials");
+        g_debug ("GdmProductSlave: Relay RefreshCredentials");
 
-        gdm_session_accredit (GDM_SESSION (slave->priv->session), GDM_SESSION_CRED_RENEW);
+        gdm_session_accredit (GDM_SESSION (slave->priv->session), GDM_SESSION_CRED_REFRESH);
 }
 
 static void
@@ -904,8 +955,8 @@ relay_dbus_handle_message (DBusConnection *connection,
                 on_relay_authorize (slave, message);
         } else if (dbus_message_is_signal (message, RELAY_SERVER_DBUS_INTERFACE, "EstablishCredentials")) {
                 on_relay_establish_credentials (slave, message);
-        } else if (dbus_message_is_signal (message, RELAY_SERVER_DBUS_INTERFACE, "RenewCredentials")) {
-                on_relay_renew_credentials (slave, message);
+        } else if (dbus_message_is_signal (message, RELAY_SERVER_DBUS_INTERFACE, "RefreshCredentials")) {
+                on_relay_refresh_credentials (slave, message);
         } else if (dbus_message_is_signal (message, RELAY_SERVER_DBUS_INTERFACE, "AnswerQuery")) {
                 on_relay_answer_query (slave, message);
         } else if (dbus_message_is_signal (message, RELAY_SERVER_DBUS_INTERFACE, "SessionSelected")) {
diff --git a/daemon/gdm-session-direct.c b/daemon/gdm-session-direct.c
index cef2923e..75dfe100 100644
--- a/daemon/gdm-session-direct.c
+++ b/daemon/gdm-session-direct.c
@@ -708,6 +708,10 @@ gdm_session_direct_handle_session_started (GdmSessionDirect *session,
         DBusError    error;
         int          pid;
 
+        pid = 0;
+
+        g_debug ("GdmSessionDirect: Handling SessionStarted");
+
         dbus_error_init (&error);
         if (! dbus_message_get_args (message, &error,
                                      DBUS_TYPE_INT32, &pid,
@@ -725,7 +729,7 @@ gdm_session_direct_handle_session_started (GdmSessionDirect *session,
         session->priv->session_pid = pid;
         session->priv->is_running = TRUE;
 
-        _gdm_session_session_started (GDM_SESSION (session));
+        _gdm_session_session_started (GDM_SESSION (session), pid);
 
         return DBUS_HANDLER_RESULT_HANDLED;
 }
@@ -1136,6 +1140,7 @@ do_introspect (DBusConnection *connection,
                                "    </method>\n"
                                "    <method name=\"SessionStarted\">\n"
                                "      <arg name=\"pid\" direction=\"in\" type=\"i\"/>\n"
+                               "      <arg name=\"environment\" direction=\"in\" type=\"as\"/>\n"
                                "    </method>\n"
                                "    <method name=\"SessionExited\">\n"
                                "      <arg name=\"code\" direction=\"in\" type=\"i\"/>\n"
@@ -1166,7 +1171,7 @@ do_introspect (DBusConnection *connection,
                                "    </signal>\n"
                                "    <signal name=\"EstablishCredentials\">\n"
                                "    </signal>\n"
-                               "    <signal name=\"RenewCredentials\">\n"
+                               "    <signal name=\"RefreshCredentials\">\n"
                                "    </signal>\n"
                                "    <signal name=\"SetEnvironmentVariable\">\n"
                                "      <arg name=\"name\" type=\"s\"/>\n"
@@ -1704,8 +1709,8 @@ gdm_session_direct_accredit (GdmSession *session,
         case GDM_SESSION_CRED_ESTABLISH:
                 send_dbus_void_signal (impl, "EstablishCredentials");
                 break;
-        case GDM_SESSION_CRED_RENEW:
-                send_dbus_void_signal (impl, "RenewCredentials");
+        case GDM_SESSION_CRED_REFRESH:
+                send_dbus_void_signal (impl, "RefreshCredentials");
                 break;
         default:
                 g_assert_not_reached ();
diff --git a/daemon/gdm-session-private.h b/daemon/gdm-session-private.h
index 57e3da00..175fa4d6 100644
--- a/daemon/gdm-session-private.h
+++ b/daemon/gdm-session-private.h
@@ -43,7 +43,8 @@ void             _gdm_session_authorization_failed         (GdmSession   *sessio
 void             _gdm_session_accredited                   (GdmSession   *session);
 void             _gdm_session_accreditation_failed         (GdmSession   *session,
                                                             const char   *text);
-void             _gdm_session_session_started              (GdmSession   *session);
+void             _gdm_session_session_started              (GdmSession   *session,
+                                                            int           pid);
 void             _gdm_session_session_start_failed         (GdmSession   *session,
                                                             const char   *message);
 void             _gdm_session_session_exited               (GdmSession   *session,
diff --git a/daemon/gdm-session-relay.c b/daemon/gdm-session-relay.c
index 7e7d3547..8fa97f9a 100644
--- a/daemon/gdm-session-relay.c
+++ b/daemon/gdm-session-relay.c
@@ -234,8 +234,8 @@ gdm_session_relay_accredit (GdmSession *session,
         case GDM_SESSION_CRED_ESTABLISH:
                 send_dbus_void_signal (impl, "EstablishCredentials");
                 break;
-        case GDM_SESSION_CRED_RENEW:
-                send_dbus_void_signal (impl, "RenewCredentials");
+        case GDM_SESSION_CRED_REFRESH:
+                send_dbus_void_signal (impl, "RefreshCredentials");
                 break;
         default:
                 g_assert_not_reached ();
@@ -354,6 +354,8 @@ handle_secret_info_query (GdmSessionRelay *session_relay,
         DBusError    error;
         const char  *text;
 
+        text = NULL;
+
         dbus_error_init (&error);
         if (! dbus_message_get_args (message, &error,
                                      DBUS_TYPE_STRING, &text,
@@ -381,6 +383,8 @@ handle_info (GdmSessionRelay *session_relay,
         DBusError    error;
         const char  *text;
 
+        text = NULL;
+
         dbus_error_init (&error);
         if (! dbus_message_get_args (message, &error,
                                      DBUS_TYPE_STRING, &text,
@@ -408,6 +412,8 @@ handle_problem (GdmSessionRelay *session_relay,
         DBusError    error;
         const char  *text;
 
+        text = NULL;
+
         dbus_error_init (&error);
         if (! dbus_message_get_args (message, &error,
                                      DBUS_TYPE_STRING, &text,
@@ -602,16 +608,26 @@ handle_session_started (GdmSessionRelay *session_relay,
 {
         DBusMessage *reply;
         DBusError    error;
+        int          pid;
 
         dbus_error_init (&error);
 
+        pid = 0;
+        if (! dbus_message_get_args (message,
+                                     &error,
+                                     DBUS_TYPE_INT32, &pid,
+                                     DBUS_TYPE_INVALID)) {
+                g_warning ("ERROR: %s", error.message);
+        }
+
         g_debug ("GdmSessionRelay: SessionStarted");
 
         reply = dbus_message_new_method_return (message);
         dbus_connection_send (connection, reply, NULL);
         dbus_message_unref (reply);
 
-        _gdm_session_session_started (GDM_SESSION (session_relay));
+        _gdm_session_session_started (GDM_SESSION (session_relay),
+                                      pid);
 
         return DBUS_HANDLER_RESULT_HANDLED;
 }
@@ -783,7 +799,7 @@ do_introspect (DBusConnection *connection,
                                "    </signal>\n"
                                "    <signal name=\"EstablishCredentials\">\n"
                                "    </signal>\n"
-                               "    <signal name=\"RenewCredentials\">\n"
+                               "    <signal name=\"RefreshCredentials\">\n"
                                "    </signal>\n"
 
                                "    <signal name=\"Open\">\n"
@@ -1093,7 +1109,6 @@ gdm_session_iface_init (GdmSessionIface *iface)
         iface->select_session = gdm_session_relay_select_session;
         iface->select_language = gdm_session_relay_select_language;
         iface->select_user = gdm_session_relay_select_user;
-
 }
 
 static void
diff --git a/daemon/gdm-session-worker.c b/daemon/gdm-session-worker.c
index 9ded9f60..b782b1cb 100644
--- a/daemon/gdm-session-worker.c
+++ b/daemon/gdm-session-worker.c
@@ -1132,14 +1132,17 @@ gdm_session_worker_set_environment_variable (GdmSessionWorker *worker,
 }
 
 static void
-gdm_session_worker_update_environment_from_passwd_entry (GdmSessionWorker *worker,
-                                                         struct passwd    *passwd_entry)
+gdm_session_worker_update_environment_from_passwd_info (GdmSessionWorker *worker,
+                                                        uid_t             uid,
+                                                        gid_t             gid,
+                                                        const char       *home,
+                                                        const char       *shell)
 {
         gdm_session_worker_set_environment_variable (worker, "LOGNAME", worker->priv->username);
         gdm_session_worker_set_environment_variable (worker, "USER", worker->priv->username);
         gdm_session_worker_set_environment_variable (worker, "USERNAME", worker->priv->username);
-        gdm_session_worker_set_environment_variable (worker, "HOME", passwd_entry->pw_dir);
-        gdm_session_worker_set_environment_variable (worker, "SHELL", passwd_entry->pw_shell);
+        gdm_session_worker_set_environment_variable (worker, "HOME", home);
+        gdm_session_worker_set_environment_variable (worker, "SHELL", shell);
 }
 
 static gboolean
@@ -1150,28 +1153,53 @@ gdm_session_worker_environment_variable_is_set (GdmSessionWorker *worker,
 }
 
 static gboolean
-gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
-                                  GError           **error)
+_change_user (GdmSessionWorker  *worker,
+              uid_t              uid,
+              gid_t              gid)
+{
+        gboolean ret;
+
+        ret = FALSE;
+
+        /* pam_setcred wants to be called as the authenticated user
+         * but pam_open_session needs to be called as super-user.
+         *
+         * Set the real uid and gid to the user and give the user a
+         * temporary super-user effective id.
+         */
+        if (setreuid (uid, GDM_SESSION_ROOT_UID) < 0) {
+                return FALSE;
+        }
+
+        if (setgid (gid) < 0) {
+                return FALSE;
+        }
+
+        if (initgroups (worker->priv->username, gid) < 0) {
+                return FALSE;
+        }
+
+        return TRUE;
+}
+
+static gboolean
+_lookup_passwd_info (const char *username,
+                     uid_t      *uidp,
+                     gid_t      *gidp,
+                     char      **homep,
+                     char      **shellp)
 {
-        int            error_code;
+        gboolean       ret;
         struct passwd *passwd_entry;
         struct passwd  passwd_buffer;
         char          *aux_buffer;
         long           required_aux_buffer_size;
         gsize          aux_buffer_size;
 
+        ret = FALSE;
         aux_buffer = NULL;
         aux_buffer_size = 0;
 
-        if (worker->priv->username == NULL) {
-                error_code = PAM_USER_UNKNOWN;
-                g_set_error (error,
-                             GDM_SESSION_WORKER_ERROR,
-                             GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             _("no user account available"));
-                goto out;
-        }
-
         required_aux_buffer_size = sysconf (_SC_GETPW_R_SIZE_MAX);
 
         if (required_aux_buffer_size < 0) {
@@ -1189,13 +1217,13 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
          */
         passwd_entry = NULL;
 #ifdef HAVE_POSIX_GETPWNAM_R
-        errno = getpwnam_r (worker->priv->username,
+        errno = getpwnam_r (username,
                             &passwd_buffer,
                             aux_buffer,
                             (size_t) aux_buffer_size,
                             &passwd_entry);
 #else
-        passwd_entry = getpwnam_r (worker->priv->username,
+        passwd_entry = getpwnam_r (username,
                                    &passwd_buffer,
                                    aux_buffer,
                                    (size_t) aux_buffer_size);
@@ -1203,25 +1231,83 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
 #endif /* !HAVE_POSIX_GETPWNAM_R */
 
         if (errno != 0) {
-                error_code = PAM_SYSTEM_ERR;
+                g_warning ("%s", g_strerror (errno));
+                goto out;
+        }
+
+        if (passwd_entry == NULL) {
+                goto out;
+        }
+
+        if (uidp != NULL) {
+                *uidp = passwd_entry->pw_uid;
+        }
+        if (gidp != NULL) {
+                *gidp = passwd_entry->pw_gid;
+        }
+        if (homep != NULL) {
+                *homep = g_strdup (passwd_entry->pw_dir);
+        }
+        if (shellp != NULL) {
+                *shellp = g_strdup (passwd_entry->pw_shell);
+        }
+        ret = TRUE;
+ out:
+        if (aux_buffer != NULL) {
+                g_assert (aux_buffer_size > 0);
+                g_slice_free1 (aux_buffer_size, aux_buffer);
+        }
+
+        return ret;
+}
+
+static gboolean
+gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
+                                  GError           **error)
+{
+        gboolean ret;
+        gboolean res;
+        uid_t    uid;
+        gid_t    gid;
+        char    *shell;
+        char    *home;
+        int      error_code;
+
+        ret = FALSE;
+
+        if (worker->priv->username == NULL) {
+                g_debug ("GdmSessionWorker: Username not set");
+                error_code = PAM_USER_UNKNOWN;
                 g_set_error (error,
                              GDM_SESSION_WORKER_ERROR,
                              GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             "%s",
-                             g_strerror (errno));
+                             _("no user account available"));
                 goto out;
         }
 
-        if (passwd_entry == NULL) {
-                error_code = PAM_USER_UNKNOWN;
+        home = NULL;
+        shell = NULL;
+        uid = 0;
+        gid = 0;
+        res = _lookup_passwd_info (worker->priv->username,
+                                   &uid,
+                                   &gid,
+                                   &home,
+                                   &shell);
+        if (! res) {
+                g_debug ("GdmSessionWorker: Unable to lookup account info");
                 g_set_error (error,
                              GDM_SESSION_WORKER_ERROR,
                              GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             _("user account not available on system"));
+                             _("no user account available"));
                 goto out;
         }
 
-        gdm_session_worker_update_environment_from_passwd_entry (worker, passwd_entry);
+        gdm_session_worker_update_environment_from_passwd_info (worker,
+                                                                uid,
+                                                                gid,
+                                                                home,
+                                                                shell);
 
         /* Let's give the user a default PATH if he doesn't already have one
          */
@@ -1229,33 +1315,12 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
                 gdm_session_worker_set_environment_variable (worker, "PATH", GDM_SESSION_DEFAULT_PATH);
         }
 
-        /* pam_setcred wants to be called as the authenticated user
-         * but pam_open_session needs to be called as super-user.
-         *
-         * Set the real uid and gid to the user and give the user a
-         * temporary super-user effective id.
-         */
-        if (setreuid (passwd_entry->pw_uid, GDM_SESSION_ROOT_UID) < 0) {
-                error_code = PAM_SYSTEM_ERR;
-                g_set_error (error, GDM_SESSION_WORKER_ERROR,
-                             GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             "%s", g_strerror (errno));
-                goto out;
-        }
-
-        if (setgid (passwd_entry->pw_gid) < 0) {
-                error_code = PAM_SYSTEM_ERR;
-                g_set_error (error, GDM_SESSION_WORKER_ERROR,
-                             GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             "%s", g_strerror (errno));
-                goto out;
-        }
-
-        if (initgroups (passwd_entry->pw_name, passwd_entry->pw_gid) < 0) {
+        if (! _change_user (worker, uid, gid)) {
+                g_debug ("GdmSessionWorker: Unable to change to user");
                 error_code = PAM_SYSTEM_ERR;
                 g_set_error (error, GDM_SESSION_WORKER_ERROR,
                              GDM_SESSION_WORKER_ERROR_GIVING_CREDENTIALS,
-                             "%s", g_strerror (errno));
+                             "%s", _("Unable to change to user"));
                 goto out;
         }
 
@@ -1270,23 +1335,19 @@ gdm_session_worker_accredit_user (GdmSessionWorker  *worker,
                 goto out;
         }
 
-        gdm_session_auditor_report_user_accredited (worker->priv->auditor);
-
-        g_debug ("GdmSessionWorker: state ACCREDITED");
-        worker->priv->state = GDM_SESSION_WORKER_STATE_ACCREDITED;
+        ret = TRUE;
 
  out:
-        if (aux_buffer != NULL) {
-                g_assert (aux_buffer_size > 0);
-                g_slice_free1 (aux_buffer_size, aux_buffer);
-        }
-
-        if (error_code != PAM_SUCCESS) {
+        if (ret) {
+                g_debug ("GdmSessionWorker: state ACCREDITED");
+                ret = TRUE;
+                gdm_session_auditor_report_user_accredited (worker->priv->auditor);
+                worker->priv->state = GDM_SESSION_WORKER_STATE_ACCREDITED;
+        } else {
                 gdm_session_worker_uninitialize_pam (worker, error_code);
-                return FALSE;
         }
 
-        return TRUE;
+        return ret;
 }
 
 static void
@@ -2153,14 +2214,18 @@ on_establish_credentials (GdmSessionWorker *worker,
 }
 
 static void
-on_renew_credentials (GdmSessionWorker *worker,
-                      DBusMessage      *message)
+on_refresh_credentials (GdmSessionWorker *worker,
+                        DBusMessage      *message)
 {
-        /* FIXME: return error if not in AUTHORIZED state */
+        int error_code;
 
-        worker->priv->cred_flags = PAM_REINITIALIZE_CRED;
+        /* FIXME: return error if not in SESSION STARTED state */
+        g_debug ("GdmSessionWorker: refreshing credentials");
 
-        queue_state_change (worker);
+        error_code = pam_setcred (worker->priv->pam_handle, PAM_REFRESH_CRED);
+        if (error_code != PAM_SUCCESS) {
+                g_debug ("GdmSessionWorker: %s", pam_strerror (worker->priv->pam_handle, error_code));
+        }
 }
 
 static DBusHandlerResult
@@ -2192,8 +2257,8 @@ worker_dbus_handle_message (DBusConnection *connection,
                 on_authorize (worker, message);
         } else if (dbus_message_is_signal (message, GDM_SESSION_DBUS_INTERFACE, "EstablishCredentials")) {
                 on_establish_credentials (worker, message);
-        } else if (dbus_message_is_signal (message, GDM_SESSION_DBUS_INTERFACE, "RenewCredentials")) {
-                on_renew_credentials (worker, message);
+        } else if (dbus_message_is_signal (message, GDM_SESSION_DBUS_INTERFACE, "RefreshCredentials")) {
+                on_refresh_credentials (worker, message);
         } else if (dbus_message_is_signal (message, GDM_SESSION_DBUS_INTERFACE, "StartProgram")) {
                 on_start_program (worker, message);
         } else if (dbus_message_is_signal (message, GDM_SESSION_DBUS_INTERFACE, "SetEnvironmentVariable")) {
diff --git a/daemon/gdm-session.c b/daemon/gdm-session.c
index c412f9df..2a4c7bd4 100644
--- a/daemon/gdm-session.c
+++ b/daemon/gdm-session.c
@@ -360,9 +360,10 @@ gdm_session_class_init (gpointer g_iface)
                               G_STRUCT_OFFSET (GdmSessionIface, session_started),
                               NULL,
                               NULL,
-                              g_cclosure_marshal_VOID__VOID,
+                              g_cclosure_marshal_VOID__INT,
                               G_TYPE_NONE,
-                              0);
+                              1,
+                              G_TYPE_INT);
         signals [SESSION_START_FAILED] =
                 g_signal_new ("session-start-failed",
                               iface_type,
@@ -554,10 +555,11 @@ _gdm_session_problem (GdmSession   *session,
 }
 
 void
-_gdm_session_session_started (GdmSession   *session)
+_gdm_session_session_started (GdmSession   *session,
+                              int           pid)
 {
         g_return_if_fail (GDM_IS_SESSION (session));
-        g_signal_emit (session, signals [SESSION_STARTED], 0);
+        g_signal_emit (session, signals [SESSION_STARTED], 0, pid);
 }
 
 void
diff --git a/daemon/gdm-session.h b/daemon/gdm-session.h
index 00eb9d3e..2a9abe01 100644
--- a/daemon/gdm-session.h
+++ b/daemon/gdm-session.h
@@ -37,7 +37,7 @@ typedef struct _GdmSessionIface GdmSessionIface;
 
 enum {
         GDM_SESSION_CRED_ESTABLISH = 0,
-        GDM_SESSION_CRED_RENEW,
+        GDM_SESSION_CRED_REFRESH,
 };
 
 struct _GdmSessionIface
@@ -93,7 +93,8 @@ struct _GdmSessionIface
                                               const char   *info);
         void (* problem)                     (GdmSession   *session,
                                               const char   *problem);
-        void (* session_started)             (GdmSession   *session);
+        void (* session_started)             (GdmSession   *session,
+                                              int           pid);
         void (* session_start_failed)        (GdmSession   *session,
                                               const char   *message);
         void (* session_exited)              (GdmSession   *session,
diff --git a/daemon/gdm-simple-slave.c b/daemon/gdm-simple-slave.c
index 8dfc0729..cc80e464 100644
--- a/daemon/gdm-simple-slave.c
+++ b/daemon/gdm-simple-slave.c
@@ -94,9 +94,12 @@ G_DEFINE_TYPE (GdmSimpleSlave, gdm_simple_slave, GDM_TYPE_SLAVE)
 
 static void
 on_session_started (GdmSession       *session,
+                    int               pid,
                     GdmSimpleSlave   *slave)
 {
-        g_debug ("GdmSimpleSlave: session started");
+        int i;
+
+        g_debug ("GdmSimpleSlave: session started %d", pid);
 
         /* FIXME: should we do something here? */
 }
@@ -210,8 +213,22 @@ static void
 gdm_simple_slave_accredit_when_ready (GdmSimpleSlave *slave)
 {
         if (slave->priv->start_session_when_ready) {
-                gdm_session_accredit (GDM_SESSION (slave->priv->session),
-                                      GDM_SESSION_CRED_ESTABLISH);
+                char *ssid;
+                char *username;
+                int   cred_flag;
+
+                username = gdm_session_direct_get_username (slave->priv->session);
+
+                ssid = gdm_slave_get_primary_session_id_for_user (slave, username);
+                if (ssid != NULL && ssid [0] != '\0') {
+                        cred_flag = GDM_SESSION_CRED_REFRESH;
+                } else {
+                        cred_flag = GDM_SESSION_CRED_ESTABLISH;
+                }
+                g_free (ssid);
+                g_free (username);
+
+                gdm_session_accredit (GDM_SESSION (slave->priv->session), cred_flag);
         } else {
                 slave->priv->waiting_to_start_session = TRUE;
         }
@@ -687,7 +704,7 @@ on_greeter_connected (GdmGreeterServer *greeter_server,
 {
         gboolean display_is_local;
 
-        g_debug ("GdmSimpleSlave: Greeter started");
+        g_debug ("GdmSimpleSlave: Greeter connected");
 
         gdm_session_open (GDM_SESSION (slave->priv->session));
 
@@ -721,8 +738,6 @@ on_start_session_later (GdmGreeterServer *session,
         slave->priv->start_session_when_ready = FALSE;
 }
 
-
-
 static void
 setup_server (GdmSimpleSlave *slave)
 {
diff --git a/daemon/gdm-slave.c b/daemon/gdm-slave.c
index bc2a9e0e..f2e4cb30 100644
--- a/daemon/gdm-slave.c
+++ b/daemon/gdm-slave.c
@@ -841,9 +841,9 @@ x11_session_is_on_seat (GdmSlave        *slave,
         return ret;
 }
 
-static char *
-_get_primary_user_session_id (GdmSlave   *slave,
-                              const char *username)
+char *
+gdm_slave_get_primary_session_id_for_user (GdmSlave   *slave,
+                                           const char *username)
 {
         gboolean    res;
         gboolean    can_activate_sessions;
@@ -1043,7 +1043,7 @@ gdm_slave_switch_to_user_session (GdmSlave   *slave,
 
         ret = FALSE;
 
-        ssid_to_activate = _get_primary_user_session_id (slave, username);
+        ssid_to_activate = gdm_slave_get_primary_session_id_for_user (slave, username);
         if (ssid_to_activate == NULL) {
                 g_debug ("GdmSlave: unable to determine session to activate");
                 goto out;
diff --git a/daemon/gdm-slave.h b/daemon/gdm-slave.h
index e6ce9425..d1213065 100644
--- a/daemon/gdm-slave.h
+++ b/daemon/gdm-slave.h
@@ -57,6 +57,9 @@ GType               gdm_slave_get_type               (void);
 gboolean            gdm_slave_start                  (GdmSlave   *slave);
 gboolean            gdm_slave_stop                   (GdmSlave   *slave);
 
+char *              gdm_slave_get_primary_session_id_for_user (GdmSlave   *slave,
+                                                               const char *username);
+
 gboolean            gdm_slave_add_user_authorization (GdmSlave   *slave,
                                                       const char *username,
                                                       char      **filename);