Author: gd Date: 2007-05-04 10:21:39 +0000 (Fri, 04 May 2007) New Revision: 22666
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22666 Log: Expand kerberos_kinit_password_ext() to return NTSTATUS codes and make winbindd's kerberized pam_auth use that. Guenther Modified: branches/SAMBA_3_0/source/libads/kerberos.c branches/SAMBA_3_0/source/nsswitch/winbindd_cred_cache.c branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c Changeset: Modified: branches/SAMBA_3_0/source/libads/kerberos.c =================================================================== --- branches/SAMBA_3_0/source/libads/kerberos.c 2007-05-04 10:02:47 UTC (rev 22665) +++ branches/SAMBA_3_0/source/libads/kerberos.c 2007-05-04 10:21:39 UTC (rev 22666) @@ -189,7 +189,8 @@ const char *cache_name, BOOL request_pac, BOOL add_netbios_addr, - time_t renewable_time) + time_t renewable_time, + NTSTATUS *ntstatus) { krb5_context ctx = NULL; krb5_error_code code = 0; @@ -267,6 +268,29 @@ *renew_till_time = (time_t) my_creds.times.renew_till; } out: + if (ntstatus) { + + NTSTATUS status; + + /* fast path */ + if (code == 0) { + *ntstatus = NT_STATUS_OK; + goto cleanup; + } + + /* try to get ntstatus code out of krb5_error when we have it + * inside the krb5_get_init_creds_opt - gd */ + + if (opt && smb_krb5_get_ntstatus_from_krb5_error_init_creds_opt(ctx, opt, &status)) { + *ntstatus = status; + goto cleanup; + } + + /* fall back to self-made-mapping */ + *ntstatus = krb5_to_nt_status(code); + } + + cleanup: krb5_free_cred_contents(ctx, &my_creds); if (me) { krb5_free_principal(ctx, me); @@ -321,7 +345,8 @@ } ret = kerberos_kinit_password_ext(s, ads->auth.password, ads->auth.time_offset, - &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable); + &ads->auth.tgt_expire, NULL, NULL, False, False, ads->auth.renewable, + NULL); if (ret) { DEBUG(0,("kerberos_kinit_password %s failed: %s\n", @@ -580,7 +605,8 @@ cache_name, False, False, - 0); + 0, + NULL); } /************************************************************************ Modified: branches/SAMBA_3_0/source/nsswitch/winbindd_cred_cache.c =================================================================== --- branches/SAMBA_3_0/source/nsswitch/winbindd_cred_cache.c 2007-05-04 10:02:47 UTC (rev 22665) +++ branches/SAMBA_3_0/source/nsswitch/winbindd_cred_cache.c 2007-05-04 10:21:39 UTC (rev 22666) @@ -111,7 +111,8 @@ entry->ccname, False, /* no PAC required anymore */ True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + NULL); gain_root_privilege(); if (ret) { @@ -224,7 +225,8 @@ entry->ccname, False, /* no PAC required anymore */ True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + NULL); gain_root_privilege(); if (ret) { Modified: branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c =================================================================== --- branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c 2007-05-04 10:02:47 UTC (rev 22665) +++ branches/SAMBA_3_0/source/nsswitch/winbindd_pam.c 2007-05-04 10:21:39 UTC (rev 22666) @@ -564,12 +564,12 @@ cc, True, True, - WINBINDD_PAM_AUTH_KRB5_RENEW_TIME); + WINBINDD_PAM_AUTH_KRB5_RENEW_TIME, + &result); if (krb5_ret) { DEBUG(1,("winbindd_raw_kerberos_login: kinit failed for '%s' with: %s (%d)\n", principal_s, error_message(krb5_ret), krb5_ret)); - result = krb5_to_nt_status(krb5_ret); goto failed; }
