diff options
| author | Andrew Tridgell <tridge@samba.org> | 2012-10-31 18:44:23 +1100 |
|---|---|---|
| committer | Andrew Tridgell <tridge@samba.org> | 2012-11-01 15:40:40 +1100 |
| commit | ed2e69fe91fee642392803a17d42d64adc36e41d (patch) | |
| tree | c9df3bc3a628bc22e11103352d679b2f72d9e651 | |
| parent | fce66b22ea312abb252fb9dc748b3adc6fbab49f (diff) | |
| download | samba-ed2e69fe91fee642392803a17d42d64adc36e41d.tar.gz samba-ed2e69fe91fee642392803a17d42d64adc36e41d.tar.bz2 samba-ed2e69fe91fee642392803a17d42d64adc36e41d.zip | |
s4-librpc: use cli_credentials_failed_kerberos_login to cope with stale tickets
This allows our RPC client code to cope with a kerberos server
changing password while we have a valid service ticket
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
| -rw-r--r-- | source4/librpc/rpc/dcerpc_util.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c index 1217e34607..15847efa9d 100644 --- a/source4/librpc/rpc/dcerpc_util.c +++ b/source4/librpc/rpc/dcerpc_util.c @@ -30,6 +30,7 @@ #include "librpc/gen_ndr/ndr_misc.h" #include "librpc/rpc/dcerpc_proto.h" #include "auth/credentials/credentials.h" +#include "auth/gensec/gensec.h" #include "param/param.h" #include "librpc/rpc/rpc_common.h" @@ -335,6 +336,7 @@ struct pipe_auth_state { const struct ndr_interface_table *table; struct loadparm_context *lp_ctx; struct cli_credentials *credentials; + unsigned int logon_retries; }; @@ -395,7 +397,19 @@ static void continue_auth_auto(struct composite_context *ctx) composite_continue(c, sec_conn_req, continue_ntlmssp_connection, c); return; } else if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) { - if (cli_credentials_wrong_password(s->credentials)) { + const char *principal; + + principal = gensec_get_target_principal(s->pipe->conn->security_state.generic_state); + if (principal == NULL) { + const char *hostname = gensec_get_target_hostname(s->pipe->conn->security_state.generic_state); + const char *service = gensec_get_target_service(s->pipe->conn->security_state.generic_state); + if (hostname != NULL && service != NULL) { + principal = talloc_asprintf(c, "%s/%s", service, hostname); + } + } + + if (cli_credentials_failed_kerberos_login(s->credentials, principal, &s->logon_retries) || + cli_credentials_wrong_password(s->credentials)) { /* * Retry SPNEGO with a better password * send a request for secondary rpc connection |