diff options
| author | Günther Deschner <gd@samba.org> | 2007-05-04 10:21:39 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 12:19:54 -0500 |
| commit | 0f436eab5b2e5891c341c27cb22db52a72bf1af7 (patch) | |
| tree | 8275c0f3ff6f2d05f3b180a5f3a2203ac16cd890 /source/libads | |
| parent | dcd902f24a59288bbb7400d59c0afc0c8303ed69 (diff) | |
| download | samba-0f436eab5b2e5891c341c27cb22db52a72bf1af7.tar.gz samba-0f436eab5b2e5891c341c27cb22db52a72bf1af7.tar.xz samba-0f436eab5b2e5891c341c27cb22db52a72bf1af7.zip | |
r22666: Expand kerberos_kinit_password_ext() to return NTSTATUS codes and make
winbindd's kerberized pam_auth use that.
Guenther
Diffstat (limited to 'source/libads')
| -rw-r--r-- | source/libads/kerberos.c | 32 |
1 files changed, 29 insertions, 3 deletions
diff --git a/source/libads/kerberos.c b/source/libads/kerberos.c index dc3d11a60c2..c721b563850 100644 --- a/source/libads/kerberos.c +++ b/source/libads/kerberos.c @@ -189,7 +189,8 @@ int kerberos_kinit_password_ext(const char *principal, const char *cache_name, BOOL request_pac, BOOL add_netbios_addr, - time_t renewable_time) + time_t renewable_time, + NTSTATUS *ntstatus) { krb5_context ctx = NULL; krb5_error_code code = 0; @@ -267,6 +268,29 @@ int kerberos_kinit_password_ext(const char *principal, *renew_till_time = (time_t) my_creds.times.renew_till; } out: + if (ntstatus) { + + NTSTATUS status; + + /* fast path */ + if (code == 0) { + *ntstatus = NT_STATUS_OK; + goto cleanup; + } + + /* try to get ntstatus code out of krb5_error when we have it + * inside the krb5_get_init_creds_opt - gd */ + + if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) { + *ntstatus = status; + goto cleanup; + } + + /* fall back to self-made-mapping */ + *ntstatus = krb5_to_nt_status(code); + } + + cleanup: krb5_free_cred_contents(ctx, &my_creds); if (me) { krb5_free_principal(ctx, me); @@ -321,7 +345,8 @@ int ads_kinit_password(ADS_STRUCT *ads) } ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset, - &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable); + &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable, + NULL); if (ret) { DEBUG(0,("kerberos_kinit_password %s failed: %s\n", @@ -580,7 +605,8 @@ int kerberos_kinit_password(const char *principal, cache_name, False, False, - 0); + 0, + NULL); } /************************************************************************ |