convert the LDAP/SASL code to use GSS-SPNEGO if possible

we now do this:

- look for suported SASL mechanisms on the LDAP server
- choose GSS-SPNEGO if possible
- within GSS-SPNEGO choose KRB5 if we can do a kinit
- otherwise use NTLMSSP

This change also means that we no longer rely on having a gssapi
library to do ADS.

todo:
- add TLS/SSL support over LDAP
- change to using LDAP/SSL for password change in ADS
(This used to be commit b04e91f660d3b26d23044075d4a7e707eb41462d)

1 files changed, 4 insertions, 0 deletions

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 16450c5b29..eb1c3fe059 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -653,6 +653,10 @@ int net_ads_join(int argc, const char **argv)
 		return -1;
 	}
 
+	if (ads_kinit_password(ads)) {
+		return -1;
+	}
+
 	rc = ads_set_machine_password(ads, global_myname, password);
 	if (!ADS_ERR_OK(rc)) {
 		d_printf("ads_set_machine_password: %s\n", ads_errstr(rc));