diff options
| -rw-r--r-- | source3/libads/krb5_errs.c | 2 | ||||
| -rw-r--r-- | source4/auth/gensec/gensec_gssapi.c | 3 |
2 files changed, 4 insertions, 1 deletions
diff --git a/source3/libads/krb5_errs.c b/source3/libads/krb5_errs.c index d4ff09a5106..8eb5d8247b1 100644 --- a/source3/libads/krb5_errs.c +++ b/source3/libads/krb5_errs.c @@ -28,7 +28,7 @@ static const struct { } krb5_to_nt_status_map[] = { {KRB5_CC_IO, NT_STATUS_UNEXPECTED_IO_ERROR}, {KRB5KDC_ERR_BADOPTION, NT_STATUS_INVALID_PARAMETER}, - {KRB5KDC_ERR_CLIENT_REVOKED, NT_STATUS_ACCESS_DENIED}, + {KRB5KDC_ERR_CLIENT_REVOKED, NT_STATUS_ACCOUNT_LOCKED_OUT}, {KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN, NT_STATUS_INVALID_ACCOUNT_NAME}, {KRB5KDC_ERR_ETYPE_NOSUPP, NT_STATUS_LOGON_FAILURE}, #if defined(KRB5KDC_ERR_KEY_EXP) /* MIT */ diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index 0bb307f989a..63fda1f807d 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -306,6 +306,9 @@ static NTSTATUS gensec_gssapi_client_creds(struct gensec_security *gensec_securi case KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN: DEBUG(1, ("Wrong username or password: %s\n", error_string)); return NT_STATUS_LOGON_FAILURE; + case KRB5KDC_ERR_CLIENT_REVOKED: + DEBUG(1, ("Account locked out: %s\n", error_string)); + return NT_STATUS_ACCOUNT_LOCKED_OUT; case KRB5_KDC_UNREACH: DEBUG(3, ("Cannot reach a KDC we require to contact %s : %s\n", gensec_gssapi_state->target_principal, error_string)); return NT_STATUS_NO_LOGON_SERVERS; |