r24804: As a temporary workaround, also try to guess the server's principal in the

"not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds
succeed with windows server 2008.

Guenther
(This used to be commit f5b3de4d3069eaa750240e3422bac5cb169b6c0a)

3 files changed, 72 insertions, 41 deletions

diff --git a/source3/include/ads.h b/source3/include/ads.h
index 0216f536c9..37d09f1e42 100644
--- a/source3/include/ads.h
+++ b/source3/include/ads.h
@@ -394,4 +394,6 @@ typedef struct {
 
 #define ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY "edacfd8f-ffb3-11d1-b41d-00a0c968f939"
 
+#define ADS_IGNORE_PRINCIPAL "not_defined_in_RFC4178@please_ignore"
+
 #endif	/* _INCLUDE_ADS_H_ */
diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index fb4fb2132d..3752d3c2ac 100644
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -657,52 +657,23 @@ static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
 
 	ZERO_STRUCTP(p);
 
-	/* I've seen a child Windows 2000 domain not send 
-	   the principal name back in the first round of 
+	/* I've seen a child Windows 2000 domain not send
+	   the principal name back in the first round of
 	   the SASL bind reply.  So we guess based on server
 	   name and realm.  --jerry  */
-	if (given_principal) {
-		p->string = SMB_STRDUP(given_principal);
-		if (!p->string) {
-			return ADS_ERROR(LDAP_NO_MEMORY);
-		}
-	} else if (ads->server.realm && ads->server.ldap_server) {
-		char *server, *server_realm;
-
-		server = SMB_STRDUP(ads->server.ldap_server);
-		server_realm = SMB_STRDUP(ads->server.realm);
-
-		if (!server || !server_realm) {
-			return ADS_ERROR(LDAP_NO_MEMORY);
-		}
-
-		strlower_m(server);
-		strupper_m(server_realm);
-		asprintf(&p->string, "ldap/%s@%s", server, server_realm);
-
-		SAFE_FREE(server);
-		SAFE_FREE(server_realm);
-
-		if (!p->string) {
-			return ADS_ERROR(LDAP_NO_MEMORY);
-		}
-	} else if (ads->config.realm && ads->config.ldap_server_name) {
-		char *server, *server_realm;
+	/* Also try best guess when we get the w2k8 ignore
+	   principal back - gd */
 
-		server = SMB_STRDUP(ads->config.ldap_server_name);
-		server_realm = SMB_STRDUP(ads->config.realm);
+	if (!given_principal ||
+	    strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
 
-		if (!server || !server_realm) {
-			return ADS_ERROR(LDAP_NO_MEMORY);
+		status = ads_guess_service_principal(ads, given_principal,
+						     &p->string);
+		if (!ADS_ERR_OK(status)) {
+			return status;
 		}
-
-		strlower_m(server);
-		strupper_m(server_realm);
-		asprintf(&p->string, "ldap/%s@%s", server, server_realm);
-
-		SAFE_FREE(server);
-		SAFE_FREE(server_realm);
-
+	} else {
+		p->string = SMB_STRDUP(given_principal);
 		if (!p->string) {
 			return ADS_ERROR(LDAP_NO_MEMORY);
 		}
diff --git a/source3/libads/util.c b/source3/libads/util.c
index 2fb9fa81b4..a0c9d8f4c4 100644
--- a/source3/libads/util.c
+++ b/source3/libads/util.c
@@ -51,4 +51,62 @@ failed:
 	SAFE_FREE(password);
 	return ret;
 }
+
+ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads,
+				       const char *given_principal,
+				       char **returned_principal)
+{
+	char *princ = NULL;
+
+	if (ads->server.realm && ads->server.ldap_server) {
+		char *server, *server_realm;
+
+		server = SMB_STRDUP(ads->server.ldap_server);
+		server_realm = SMB_STRDUP(ads->server.realm);
+
+		if (!server || !server_realm) {
+			return ADS_ERROR(LDAP_NO_MEMORY);
+		}
+
+		strlower_m(server);
+		strupper_m(server_realm);
+		asprintf(&princ, "ldap/%s@%s", server, server_realm);
+
+		SAFE_FREE(server);
+		SAFE_FREE(server_realm);
+
+		if (!princ) {
+			return ADS_ERROR(LDAP_NO_MEMORY);
+		}
+	} else if (ads->config.realm && ads->config.ldap_server_name) {
+		char *server, *server_realm;
+
+		server = SMB_STRDUP(ads->config.ldap_server_name);
+		server_realm = SMB_STRDUP(ads->config.realm);
+
+		if (!server || !server_realm) {
+			return ADS_ERROR(LDAP_NO_MEMORY);
+		}
+
+		strlower_m(server);
+		strupper_m(server_realm);
+		asprintf(&princ, "ldap/%s@%s", server, server_realm);
+
+		SAFE_FREE(server);
+		SAFE_FREE(server_realm);
+
+		if (!princ) {
+			return ADS_ERROR(LDAP_NO_MEMORY);
+		}
+	}
+
+	if (!princ) {
+		return ADS_ERROR(LDAP_PARAM_ERROR);
+	}
+
+	*returned_principal = princ;
+
+	return ADS_SUCCESS;
+}
+
 #endif