11 files changed, 558 insertions, 335 deletions

diff --git a/source4/auth/gensec/gensec.c b/source4/auth/gensec/gensec.c
index 77ba58fcde..1608f21114 100644
--- a/source4/auth/gensec/gensec.c
+++ b/source4/auth/gensec/gensec.c
@@ -42,11 +42,15 @@ static const struct gensec_security_ops *gensec_security_by_authtype(uint8_t aut
 
 static const struct gensec_security_ops *gensec_security_by_oid(const char *oid_string)
 {
-	int i;
+	int i, j;
 	for (i=0; i < gensec_num_backends; i++) {
-		if (generic_security_ops[i]->oid &&
-		    (strcmp(generic_security_ops[i]->oid, oid_string) == 0)) {
-			return generic_security_ops[i];
+		if (generic_security_ops[i]->oid) {
+			for (j=0; generic_security_ops[i]->oid[j]; j++) { 
+				if (generic_security_ops[i]->oid[j] &&
+				    (strcmp(generic_security_ops[i]->oid[j], oid_string) == 0)) {
+					return generic_security_ops[i];
+				}
+			}
 		}
 	}
 
@@ -85,16 +89,99 @@ const struct gensec_security_ops **gensec_security_all(int *num_backends_out)
 	return generic_security_ops;
 }
 
-const char **gensec_security_oids(TALLOC_CTX *mem_ctx, const char *skip) 
+/**
+ * Return a unique list of security subsystems from those specified in
+ * the OID list.  That is, where two OIDs refer to the same module,
+ * return that module only once 
+ *
+ * The list is in the exact order of the OIDs asked for, where available.
+ */
+
+const struct gensec_security_ops_wrapper *gensec_security_by_oid_list(TALLOC_CTX *mem_ctx, 
+								      const char **oid_strings,
+								      const char *skip)
 {
-	int i, j = 0;
-	const char **oid_list;
+	struct gensec_security_ops_wrapper *backends_out;
+	const struct gensec_security_ops **backends;
+	int i, j, k, oid_idx;
+	int num_backends_out = 0;
 	int num_backends;
-	const struct gensec_security_ops **ops = gensec_security_all(&num_backends);
+
+	if (!oid_strings) {
+		return NULL;
+	}
+
+	backends = gensec_security_all(&num_backends);
+
+	backends_out = talloc_array(mem_ctx, struct gensec_security_ops_wrapper, 1);
+	if (!backends_out) {
+		return NULL;
+	}
+	backends_out[0].op = NULL;
+	backends_out[0].oid = NULL;
+
+	for (oid_idx = 0; oid_strings[oid_idx]; oid_idx++) {
+		if (strcmp(oid_strings[oid_idx], skip) == 0) {
+			continue;
+		}
+
+		for (i=0; i < num_backends; i++) {
+			if (!backends[i]->oid) {
+				continue;
+			}
+			for (j=0; backends[i]->oid[j]; j++) { 
+				if (!backends[i]->oid[j] ||
+				    !(strcmp(backends[i]->oid[j], 
+					    oid_strings[oid_idx]) == 0)) {
+					continue;
+				}
+				
+				for (k=0; backends_out[k].op; k++) {
+					if (backends_out[k].op == backends[i]) {
+						break;
+					}
+				}
+				
+				if (k < num_backends_out) {
+					/* already in there */
+					continue;
+				}
+
+				backends_out = talloc_realloc(mem_ctx, backends_out, 
+							      struct gensec_security_ops_wrapper, 
+							      num_backends_out + 2);
+				if (!backends_out) {
+					return NULL;
+				}
+				
+				backends_out[num_backends_out].op = backends[i];
+				backends_out[num_backends_out].oid = backends[i]->oid[j];
+				num_backends_out++;
+				backends_out[num_backends_out].op = NULL;
+				backends_out[num_backends_out].oid = NULL;
+			}
+		}
+	}
+	return backends_out;
+}
+
+/**
+ * Return OIDS from the security subsystems listed
+ */
+
+const char **gensec_security_oids_from_ops(TALLOC_CTX *mem_ctx, 
+					   const struct gensec_security_ops **ops,				   
+					   int num_backends,
+					   const char *skip) 
+{
+	int i;
+	int j = 0;
+	int k;
+	const char **oid_list;
 	if (!ops) {
 		return NULL;
 	}
-	oid_list = talloc_array(mem_ctx, const char *, num_backends + 1);
+	oid_list = talloc_array(mem_ctx, const char *, 1);
 	if (!oid_list) {
 		return NULL;
 	}
@@ -104,17 +191,37 @@ const char **gensec_security_oids(TALLOC_CTX *mem_ctx, const char *skip)
 			continue;
 		}
 		
-		if (skip && strcmp(skip, ops[i]->oid)==0) {
-			continue;
+		for (k = 0; ops[i]->oid[k]; k++) {
+			if (skip && strcmp(skip, ops[i]->oid[k])==0) {
+			} else {
+				oid_list = talloc_realloc(mem_ctx, oid_list, const char *, j + 2);
+				if (!oid_list) {
+					return NULL;
+				}
+				oid_list[j] = ops[i]->oid[k];
+				j++;
+			}
 		}
-
-		oid_list[j] = ops[i]->oid;
-		j++;
 	}
 	oid_list[j] = NULL;
 	return oid_list;
 }
 
+
+/**
+ * Return all the security subsystems currently enabled in GENSEC 
+ */
+
+const char **gensec_security_oids(TALLOC_CTX *mem_ctx, const char *skip) 
+{
+	int num_backends;
+	const struct gensec_security_ops **ops = gensec_security_all(&num_backends);
+	return gensec_security_oids_from_ops(mem_ctx, ops, 
+					     num_backends, skip);
+}
+
+
+
 /**
   Start the GENSEC system, returning a context pointer.
   @param mem_ctx The parent TALLOC memory context.
@@ -284,6 +391,18 @@ const char *gensec_get_name_by_oid(const char *oid_string)
 	
 
 /** 
+ * Start a GENSEC sub-mechanism with a specifed mechansim structure, used in SPNEGO
+ *
+ */
+
+NTSTATUS gensec_start_mech_by_ops(struct gensec_security *gensec_security, 
+				  const struct gensec_security_ops *ops) 
+{
+	gensec_security->ops = ops;
+	return gensec_start_mech(gensec_security);
+}
+
+/** 
  * Start a GENSEC sub-mechanism by OID, used in SPNEGO
  *
  * @note This should also be used when you wish to just start NLTMSSP (for example), as it uses a
diff --git a/source4/auth/gensec/gensec.h b/source4/auth/gensec/gensec.h
index 268881e4ba..be6731abfa 100644
--- a/source4/auth/gensec/gensec.h
+++ b/source4/auth/gensec/gensec.h
@@ -54,7 +54,7 @@ struct gensec_security_ops {
 	const char *name;
 	const char *sasl_name;
 	uint8_t auth_type;  /* 0 if not offered on DCE-RPC */
-	const char *oid;  /* NULL if not offered by SPNEGO */
+	const char **oid;  /* NULL if not offered by SPNEGO */
 	NTSTATUS (*client_start)(struct gensec_security *gensec_security);
 	NTSTATUS (*server_start)(struct gensec_security *gensec_security);
 	NTSTATUS (*update)(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx,
@@ -92,6 +92,11 @@ struct gensec_security_ops {
 	BOOL enabled;
 };
 	
+struct gensec_security_ops_wrapper {
+	const struct gensec_security_ops *op;
+	const char *oid;
+};
+
 #define GENSEC_INTERFACE_VERSION 0
 
 struct gensec_security {
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index b93d6ee33d..e57739c85c 100644
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -35,9 +35,6 @@
 static const gss_OID_desc gensec_gss_krb5_mechanism_oid_desc =
         {9, (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02")};
 
-static const gss_OID_desc gensec_gss_spnego_mechanism_oid_desc =
-        {6, (void *)discard_const_p(char, "\x2b\x06\x01\x05\x05\x02")};
-
 struct gensec_gssapi_state {
 	gss_ctx_id_t gssapi_context;
 	struct gss_channel_bindings_struct *input_chan_bindings;
@@ -48,11 +45,49 @@ struct gensec_gssapi_state {
 
 	DATA_BLOB session_key;
 	DATA_BLOB pac;
+
+	krb5_context krb5_context;
+	krb5_ccache ccache;
+	const char *ccache_name;
+
+	gss_cred_id_t cred;
 };
+
+static char *gssapi_error_string(TALLOC_CTX *mem_ctx, 
+				 OM_uint32 maj_stat, OM_uint32 min_stat)
+{
+	OM_uint32 disp_min_stat, disp_maj_stat;
+	gss_buffer_desc maj_error_message;
+	gss_buffer_desc min_error_message;
+	OM_uint32 msg_ctx = 0;
+
+	char *ret;
+
+	maj_error_message.value = NULL;
+	min_error_message.value = NULL;
+	
+	disp_maj_stat = gss_display_status(&disp_min_stat, maj_stat, GSS_C_GSS_CODE,
+			   GSS_C_NULL_OID, &msg_ctx, &maj_error_message);
+	disp_maj_stat = gss_display_status(&disp_min_stat, min_stat, GSS_C_MECH_CODE,
+			   GSS_C_NULL_OID, &msg_ctx, &min_error_message);
+	ret = talloc_asprintf(mem_ctx, "%s: %s", (char *)maj_error_message.value, (char *)min_error_message.value);
+
+	gss_release_buffer(&disp_min_stat, &maj_error_message);
+	gss_release_buffer(&disp_min_stat, &min_error_message);
+
+	return ret;
+}
+
+
 static int gensec_gssapi_destory(void *ptr) 
 {
 	struct gensec_gssapi_state *gensec_gssapi_state = ptr;
 	OM_uint32 maj_stat, min_stat;
+	
+	if (gensec_gssapi_state->cred != GSS_C_NO_CREDENTIAL) {
+		maj_stat = gss_release_cred(&min_stat, 
+					    &gensec_gssapi_state->cred);
+	}
 
 	if (gensec_gssapi_state->gssapi_context != GSS_C_NO_CONTEXT) {
 		maj_stat = gss_delete_sec_context (&min_stat,
@@ -66,13 +101,17 @@ static int gensec_gssapi_destory(void *ptr)
 	if (gensec_gssapi_state->client_name != GSS_C_NO_NAME) {
 		maj_stat = gss_release_name(&min_stat, &gensec_gssapi_state->client_name);
 	}
+	if (gensec_gssapi_state->krb5_context) {
+		krb5_free_context(gensec_gssapi_state->krb5_context);
+	}
 	return 0;
 }
 
 static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
 {
 	struct gensec_gssapi_state *gensec_gssapi_state;
-
+	krb5_error_code ret;
+	
 	gensec_gssapi_state = talloc(gensec_security, struct gensec_gssapi_state);
 	if (!gensec_gssapi_state) {
 		return NT_STATUS_NO_MEMORY;
@@ -84,8 +123,6 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
 	gensec_gssapi_state->server_name = GSS_C_NO_NAME;
 	gensec_gssapi_state->client_name = GSS_C_NO_NAME;
 
-	talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destory); 
-
 	/* TODO: Fill in channel bindings */
 	gensec_gssapi_state->input_chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
 	
@@ -95,6 +132,12 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
 	gensec_gssapi_state->session_key = data_blob(NULL, 0);
 	gensec_gssapi_state->pac = data_blob(NULL, 0);
 
+	gensec_gssapi_state->krb5_context = NULL;
+
+	gensec_gssapi_state->cred = GSS_C_NO_CREDENTIAL;
+
+	talloc_set_destructor(gensec_gssapi_state, gensec_gssapi_destory); 
+
 	if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
 #ifndef HAVE_GSSKRB5_GET_INITIATOR_SUBKEY
 		/* GSSAPI won't give us the session keys, without the
@@ -119,15 +162,29 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
 #endif
 	}
 
-	if ((strcmp(gensec_security->ops->oid, GENSEC_OID_KERBEROS5) == 0)
-		|| (strcmp(gensec_security->ops->oid, GENSEC_OID_KERBEROS5_OLD) == 0)) {
-		gensec_gssapi_state->gss_oid = &gensec_gss_krb5_mechanism_oid_desc;
-	} else if (strcmp(gensec_security->ops->oid, GENSEC_OID_SPNEGO) == 0) {
-		gensec_gssapi_state->gss_oid = &gensec_gss_spnego_mechanism_oid_desc;
-	} else {
-		DEBUG(1, ("gensec_gssapi incorrectly configured - cannot determine gss OID from %s\n", 
-			  gensec_security->ops->oid));
-		return NT_STATUS_INVALID_PARAMETER;
+	gensec_gssapi_state->gss_oid = &gensec_gss_krb5_mechanism_oid_desc;
+	
+	ret = krb5_init_context(&gensec_gssapi_state->krb5_context);
+	if (ret) {
+		DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n", 					
+			 smb_get_krb5_error_message(gensec_gssapi_state->krb5_context, 
+						    ret, gensec_gssapi_state)));
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+	
+	if (lp_realm() && *lp_realm()) {
+		char *upper_realm = strupper_talloc(gensec_gssapi_state, lp_realm());
+		if (!upper_realm) {
+			DEBUG(1,("gensec_krb5_start: could not uppercase realm: %s\n", lp_realm()));
+			return NT_STATUS_NO_MEMORY;
+		}
+		ret = krb5_set_default_realm(gensec_gssapi_state->krb5_context, upper_realm);
+		if (ret) {
+			DEBUG(1,("gensec_krb5_start: krb5_set_default_realm failed (%s)\n", 
+				 smb_get_krb5_error_message(gensec_gssapi_state->krb5_context, 
+							    ret, gensec_gssapi_state)));
+			return NT_STATUS_INTERNAL_ERROR;
+		}
 	}
 
 	return NT_STATUS_OK;
@@ -154,10 +211,7 @@ static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_securi
 	NTSTATUS nt_status;
 	gss_buffer_desc name_token;
 	OM_uint32 maj_stat, min_stat;
-
-	gss_OID_desc hostbased = {10, 
-				  (void *)discard_const_p(char, "\x2a\x86\x48\x86\xf7\x12"
-							  "\x01\x02\x01\x04")};
+	const char *ccache_name;
 
 	nt_status = gensec_gssapi_start(gensec_security);
 	if (!NT_STATUS_IS_OK(nt_status)) {
@@ -168,18 +222,67 @@ static NTSTATUS gensec_gssapi_client_start(struct gensec_security *gensec_securi
 
 	name_token.value = talloc_asprintf(gensec_gssapi_state, "%s@%s", gensec_get_target_service(gensec_security), 
 					   gensec_get_target_hostname(gensec_security));
-	DEBUG(0, ("name: %s\n", (char *)name_token.value));
 	name_token.length = strlen(name_token.value);
 
 	maj_stat = gss_import_name (&min_stat,
 				    &name_token,
-				    &hostbased,
+				    GSS_C_NT_HOSTBASED_SERVICE,
 				    &gensec_gssapi_state->server_name);
+	if (maj_stat) {
+		DEBUG(1, ("GSS Import name of %s failed: %s\n",
+			  (char *)name_token.value,
+			  gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+		return NT_STATUS_UNSUCCESSFUL;
+	}
+
+	name_token.value = cli_credentials_get_principal(gensec_get_credentials(gensec_security), gensec_gssapi_state),
+	name_token.length = strlen(name_token.value);
+
+	maj_stat = gss_import_name (&min_stat,
+				    &name_token,
+				    GSS_C_NT_USER_NAME,
+				    &gensec_gssapi_state->client_name);
+	if (maj_stat) {
+		DEBUG(1, ("GSS Import name of %s failed: %s\n",
+			  (char *)name_token.value,
+			  gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+		return NT_STATUS_UNSUCCESSFUL;
+	}
 
+	initialize_krb5_error_table();
+	
+	nt_status = kinit_to_ccache(gensec_gssapi_state, 
+				    gensec_get_credentials(gensec_security),
+				    gensec_gssapi_state->krb5_context, 
+				    &gensec_gssapi_state->ccache, &gensec_gssapi_state->ccache_name);
+	if (!NT_STATUS_IS_OK(nt_status)) {
+		return nt_status;
+	}
+
+	maj_stat = gss_krb5_ccache_name(&min_stat, 
+					gensec_gssapi_state->ccache_name, 
+					NULL);
+	if (maj_stat) {
+		DEBUG(1, ("GSS krb5 ccache set %s failed: %s\n",
+			  ccache_name,
+			  gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
+		return NT_STATUS_UNSUCCESSFUL;
+	}
 
+	maj_stat = gss_acquire_cred(&min_stat, 
+				    gensec_gssapi_state->client_name,
+				    GSS_C_INDEFINITE,
+				    GSS_C_NULL_OID_SET,
+				    GSS_C_INITIATE,
+				    &gensec_gssapi_state->cred,
+				    NULL, 
+				    NULL);
 	if (maj_stat) {
+		DEBUG(1, ("Aquiring initiator credentails failed: %s\n", 
+			  gssapi_error_string(gensec_gssapi_state, maj_stat, min_stat)));
 		return NT_STATUS_UNSUCCESSFUL;
 	}
+
 	return NT_STATUS_OK;
 }
 
@@ -256,22 +359,10 @@ static NTSTATUS gensec_gssapi_update(struct gensec_security *gensec_security,
 	} else if (maj_stat == GSS_S_CONTINUE_NEEDED) {
 		return NT_STATUS_MORE_PROCESSING_REQUIRED;
 	} else {
-		gss_buffer_desc msg1, msg2;
-		OM_uint32 msg_ctx = 0;
-		
-		msg1.value = NULL;
-		msg2.value = NULL;
-		gss_display_status(&min_stat2, maj_stat, GSS_C_GSS_CODE,
-				   GSS_C_NULL_OID, &msg_ctx, &msg1);
-		gss_display_status(&min_stat2, min_stat, GSS_C_MECH_CODE,
-				   GSS_C_NULL_OID, &msg_ctx, &msg2);
-		DEBUG(1, ("gensec_gssapi_update: %s : %s\n", (char *)msg1.value, (char *)msg2.value));
-		gss_release_buffer(&min_stat2, &msg1);
-		gss_release_buffer(&min_stat2, &msg2);
-
+		DEBUG(1, ("GSS Update failed: %s\n", 
+			  gssapi_error_string(out_mem_ctx, maj_stat, min_stat)));
 		return nt_status;
 	}
-	
 }
 
 static NTSTATUS gensec_gssapi_wrap(struct gensec_security *gensec_security, 
@@ -294,6 +385,8 @@ static NTSTATUS gensec_gssapi_wrap(struct gensec_security *gensec_security,
 			    &conf_state,
 			    &output_token);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS Wrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 	*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
@@ -327,6 +420,8 @@ static NTSTATUS gensec_gssapi_unwrap(struct gensec_security *gensec_security,
 			      &conf_state,
 			      &qop_state);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS UnWrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 	*out = data_blob_talloc(mem_ctx, output_token.value, output_token.length);
@@ -369,6 +464,8 @@ static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_securit
 			    &conf_state,
 			    &output_token);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS Wrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -381,10 +478,9 @@ static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_securit
 	memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);
 	*sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
 
-DEBUG(0,("gensec_gssapi_seal_packet: siglen: %d inlen: %d, wrap_len: %d\n", sig->length, length, output_token.length - sig_length));
-dump_data(0,sig->data, sig->length);
-dump_data(0,data, length);
-dump_data(0,((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
+	dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
+	dump_data_pw("gensec_gssapi_seal_packet: clear\n", data, length);
+	dump_data_pw("gensec_gssapi_seal_packet: sealed\n", ((uint8_t *)output_token.value) + sig_length, output_token.length - sig_length);
 
 	gss_release_buffer(&min_stat, &output_token);
 
@@ -408,8 +504,7 @@ static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_secur
 	gss_qop_t qop_state;
 	DATA_BLOB in;
 
-DEBUG(0,("gensec_gssapi_unseal_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+	dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
 
 	in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
 
@@ -426,6 +521,8 @@ dump_data(0,sig->data, sig->length);
 			      &conf_state,
 			      &qop_state);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS UnWrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -467,6 +564,8 @@ static NTSTATUS gensec_gssapi_sign_packet(struct gensec_security *gensec_securit
 			    &conf_state,
 			    &output_token);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS Wrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -479,8 +578,7 @@ static NTSTATUS gensec_gssapi_sign_packet(struct gensec_security *gensec_securit
 	/*memcpy(data, ((uint8_t *)output_token.value) + sig_length, length);*/
 	*sig = data_blob_talloc(mem_ctx, (uint8_t *)output_token.value, sig_length);
 
-DEBUG(0,("gensec_gssapi_sign_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+	dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
 
 	gss_release_buffer(&min_stat, &output_token);
 
@@ -500,8 +598,7 @@ static NTSTATUS gensec_gssapi_check_packet(struct gensec_security *gensec_securi
 	gss_qop_t qop_state;
 	DATA_BLOB in;
 
-DEBUG(0,("gensec_gssapi_check_packet: siglen: %d\n", sig->length));
-dump_data(0,sig->data, sig->length);
+	dump_data_pw("gensec_gssapi_seal_packet: sig\n", sig->data, sig->length);
 
 	in = data_blob_talloc(mem_ctx, NULL, sig->length + length);
 
@@ -518,6 +615,8 @@ dump_data(0,sig->data, sig->length);
 			      &conf_state,
 			      &qop_state);
 	if (GSS_ERROR(maj_stat)) {
+		DEBUG(1, ("GSS UnWrap failed: %s\n", 
+			  gssapi_error_string(mem_ctx, maj_stat, min_stat)));
 		return NT_STATUS_ACCESS_DENIED;
 	}
 
@@ -525,8 +624,6 @@ dump_data(0,sig->data, sig->length);
 		return NT_STATUS_INTERNAL_ERROR;
 	}
 
-	/*memcpy(data, output_token.value, length);*/
-
 	gss_release_buffer(&min_stat, &output_token);
 
 	return NT_STATUS_OK;
@@ -564,8 +661,10 @@ static NTSTATUS gensec_gssapi_session_key(struct gensec_security *gensec_securit
 	}
 
 #ifdef HAVE_GSSKRB5_GET_INITIATOR_SUBKEY
+	/* Ensure we only call this for GSSAPI/krb5, otherwise things could get very ugly */
 	if ((gensec_gssapi_state->gss_oid->length == gensec_gss_krb5_mechanism_oid_desc.length)
-	    && (memcmp(gensec_gssapi_state->gss_oid->elements, gensec_gss_krb5_mechanism_oid_desc.elements, gensec_gssapi_state->gss_oid->length) == 0)) {
+	    && (memcmp(gensec_gssapi_state->gss_oid->elements, gensec_gss_krb5_mechanism_oid_desc.elements, 
+		       gensec_gssapi_state->gss_oid->length) == 0)) {
 		OM_uint32 maj_stat, min_stat;
 		gss_buffer_desc skey;
 		
@@ -661,33 +760,16 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi
 	return NT_STATUS_OK;
 }
 
-/* As a server, this could in theory accept any GSSAPI mech */
-static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
-	.name		= "gssapi_krb5",
-	.sasl_name	= "GSSAPI",
-	.auth_type	= DCERPC_AUTH_TYPE_KRB5,
-	.oid            = GENSEC_OID_KERBEROS5,
-	.client_start   = gensec_gssapi_client_start,
-	.server_start   = gensec_gssapi_server_start,
-	.update 	= gensec_gssapi_update,
-	.session_key	= gensec_gssapi_session_key,
-	.session_info	= gensec_gssapi_session_info,
-	.sig_size	= gensec_gssapi_sig_size,
-	.sign_packet	= gensec_gssapi_sign_packet,
-	.check_packet	= gensec_gssapi_check_packet,
-	.seal_packet	= gensec_gssapi_seal_packet,
-	.unseal_packet	= gensec_gssapi_unseal_packet,
-	.wrap           = gensec_gssapi_wrap,
-	.unwrap         = gensec_gssapi_unwrap,
-	.have_feature   = gensec_gssapi_have_feature,
-	.enabled        = False
-
+static const char *gensec_krb5_oids[] = { 
+	GENSEC_OID_KERBEROS5,
+	GENSEC_OID_KERBEROS5_OLD,
+	NULL 
 };
 
 /* As a server, this could in theory accept any GSSAPI mech */
-static const struct gensec_security_ops gensec_gssapi_ms_krb5_security_ops = {
-	.name		= "gssapi_ms_krb5",
-	.oid            = GENSEC_OID_KERBEROS5_OLD,
+static const struct gensec_security_ops gensec_gssapi_krb5_security_ops = {
+	.name		= "gssapi_krb5",
+	.oid            = gensec_krb5_oids,
 	.client_start   = gensec_gssapi_client_start,
 	.server_start   = gensec_gssapi_server_start,
 	.update 	= gensec_gssapi_update,
@@ -702,26 +784,6 @@ static const struct gensec_security_ops gensec_gssapi_ms_krb5_security_ops = {
 	.unwrap         = gensec_gssapi_unwrap,
 	.have_feature   = gensec_gssapi_have_feature,
 	.enabled        = False
-
-};
-
-static const struct gensec_security_ops gensec_gssapi_spnego_security_ops = {
-	.name		= "gssapi_spnego",
-	.sasl_name	= "GSS-SPNEGO",
-	.oid            = GENSEC_OID_SPNEGO,
-	.client_start   = gensec_gssapi_client_start,
-	.server_start   = gensec_gssapi_server_start,
-	.update 	= gensec_gssapi_update,
-	.session_key	= gensec_gssapi_session_key,
-	.sig_size	= gensec_gssapi_sig_size,
-	.sign_packet	= gensec_gssapi_sign_packet,
-	.check_packet	= gensec_gssapi_check_packet,
-	.seal_packet	= gensec_gssapi_seal_packet,
-	.unseal_packet	= gensec_gssapi_unseal_packet,
-	.wrap           = gensec_gssapi_wrap,
-	.unwrap         = gensec_gssapi_unwrap,
-	.have_feature   = gensec_gssapi_have_feature,
-	.enabled        = False
 };
 
 NTSTATUS gensec_gssapi_init(void)
@@ -735,20 +797,5 @@ NTSTATUS gensec_gssapi_init(void)
 		return ret;
 	}
 
-
-	ret = gensec_register(&gensec_gssapi_ms_krb5_security_ops);
-	if (!NT_STATUS_IS_OK(ret)) {
-		DEBUG(0,("Failed to register '%s' gensec backend!\n",
-			gensec_gssapi_ms_krb5_security_ops.name));
-		return ret;
-	}
-
-	ret = gensec_register(&gensec_gssapi_spnego_security_ops);
-	if (!NT_STATUS_IS_OK(ret)) {
-		DEBUG(0,("Failed to register '%s' gensec backend!\n",
-			gensec_gssapi_spnego_security_ops.name));
-		return ret;
-	}
-
 	return ret;
 }
diff --git a/source4/auth/gensec/gensec_krb5.c b/source4/auth/gensec/gensec_krb5.c
index c850d93fce..9e2d113cb8 100644
--- a/source4/auth/gensec/gensec_krb5.c
+++ b/source4/auth/gensec/gensec_krb5.c
@@ -53,9 +53,9 @@ struct gensec_krb5_state {
 
 #ifdef KRB5_DO_VERIFY_PAC
 static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
-					    struct PAC_SIGNATURE_DATA *sig,
-					    struct gensec_krb5_state *gensec_krb5_state,
-					    uint32 keyusage)
+					 struct PAC_SIGNATURE_DATA *sig,
+					 struct gensec_krb5_state *gensec_krb5_state,
+					 uint32 keyusage)
 {
 	krb5_error_code ret;
 	krb5_crypto crypto;
@@ -222,7 +222,9 @@ static NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
 		return status;
 	}
 #endif
-	DEBUG(0,("account_name: %s [%s]\n",logon_info->info3.base.account_name.string, logon_info->info3.base.full_name.string));
+	DEBUG(0,("account_name: %s [%s]\n",
+		 logon_info->info3.base.account_name.string, 
+		 logon_info->info3.base.full_name.string));
 	*logon_info_out = logon_info;
 
 	return status;
@@ -233,12 +235,10 @@ static int gensec_krb5_destory(void *ptr)
 	struct gensec_krb5_state *gensec_krb5_state = ptr;
 
 	if (gensec_krb5_state->ticket.length) { 
-		kerberos_free_data_contents(gensec_krb5_state->context, &gensec_krb5_state->ticket); 
-	}
-	if (gensec_krb5_state->ccache) {
-		/* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
-		krb5_cc_close(gensec_krb5_state->context, gensec_krb5_state->ccache);
+		kerberos_free_data_contents(gensec_krb5_state->context, 
+					    &gensec_krb5_state->ticket); 
 	}
+	/* ccache freed in a child destructor */
 
 	krb5_free_keyblock_contents(gensec_krb5_state->context, 
 				    &gensec_krb5_state->keyblock);
@@ -279,7 +279,9 @@ static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security)
 
 	ret = krb5_init_context(&gensec_krb5_state->context);
 	if (ret) {
-		DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n", error_message(ret)));
+		DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n", 
+			 smb_get_krb5_error_message(gensec_krb5_state->context, 
+						    ret, gensec_krb5_state)));
 		return NT_STATUS_INTERNAL_ERROR;
 	}
 
@@ -291,14 +293,18 @@ static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security)
 		}
 		ret = krb5_set_default_realm(gensec_krb5_state->context, upper_realm);
 		if (ret) {
-			DEBUG(1,("gensec_krb5_start: krb5_set_default_realm failed (%s)\n", error_message(ret)));
+			DEBUG(1,("gensec_krb5_start: krb5_set_default_realm failed (%s)\n", 
+				 smb_get_krb5_error_message(gensec_krb5_state->context, 
+							    ret, gensec_krb5_state)));
 			return NT_STATUS_INTERNAL_ERROR;
 		}
 	}
 
 	ret = krb5_auth_con_init(gensec_krb5_state->context, &gensec_krb5_state->auth_context);
 	if (ret) {
-		DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n", error_message(ret)));
+		DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n", 
+			 smb_get_krb5_error_message(gensec_krb5_state->context, 
+						    ret, gensec_krb5_state)));
 		return NT_STATUS_INTERNAL_ERROR;
 	}
 
@@ -326,6 +332,8 @@ static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security
 	struct gensec_krb5_state *gensec_krb5_state;
 	krb5_error_code ret;
 	NTSTATUS nt_status;
+	const char *ccache_name;
+
 	const char *hostname = gensec_get_target_hostname(gensec_security);
 	if (!hostname) {
 		DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
@@ -347,7 +355,7 @@ static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security
 	ret = krb5_cc_default(gensec_krb5_state->context, &gensec_krb5_state->ccache);
 	if (ret) {
 		DEBUG(1,("krb5_cc_default failed (%s)\n",
-			 error_message(ret)));
+			 smb_get_krb5_error_message(gensec_krb5_state->context, ret, gensec_krb5_state)));
 		return NT_STATUS_INTERNAL_ERROR;
 	}
 	
@@ -370,7 +378,7 @@ static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security
 			return NT_STATUS_OK;
 		case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
 			DEBUG(3, ("Server [%s] is not registered with our KDC: %s\n", 
-				  hostname, error_message(ret)));
+				  hostname, smb_get_krb5_error_message(gensec_krb5_state->context, ret, gensec_krb5_state)));
 			return NT_STATUS_ACCESS_DENIED;
 		case KRB5KDC_ERR_PREAUTH_FAILED:
 		case KRB5KRB_AP_ERR_TKT_EXPIRED:
@@ -380,7 +388,7 @@ static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security
 		case KRB5_KDCREP_SKEW:
 		{
 			DEBUG(3, ("kerberos (mk_req) failed: %s\n", 
-				  error_message(ret)));
+				  smb_get_krb5_error_message(gensec_krb5_state->context, ret, gensec_krb5_state)));
 			/* fall down to remaining code */
 		}
 
@@ -390,59 +398,20 @@ static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security
 		case KRB5_CC_NOTFOUND:
 		case ENOENT:
 			
-		{
-			const char *password;
-			char *ccache_string;
-			time_t kdc_time = 0;
-			password = cli_credentials_get_password(gensec_security->credentials);
-			if (!NT_STATUS_IS_OK(nt_status)) {
-				return nt_status;
-			}
-			
-			/* this string should be unique */
-			ccache_string = talloc_asprintf(gensec_krb5_state, "MEMORY:%s:%s:%s", 
-							cli_credentials_get_principal(gensec_security->credentials, gensec_krb5_state), 
-							gensec_get_target_hostname(gensec_security),
-							generate_random_str(gensec_krb5_state, 16));
-
-			ret = krb5_cc_resolve(gensec_krb5_state->context, ccache_string, &gensec_krb5_state->ccache);
-			if (ret) {
-				DEBUG(1,("failed to generate a new krb5 keytab (%s): %s\n", 
-					 ccache_string,
-					 error_message(ret)));
-				return NT_STATUS_INTERNAL_ERROR;
-			}
-
-			ret = kerberos_kinit_password_cc(gensec_krb5_state->context, gensec_krb5_state->ccache, 
-							 cli_credentials_get_principal(gensec_security->credentials, gensec_krb5_state), 
-							 password, NULL, &kdc_time);
-
-			/* cope with ticket being in the future due to clock skew */
-			if ((unsigned)kdc_time > time(NULL)) {
-				time_t t = time(NULL);
-				int time_offset =(unsigned)kdc_time-t;
-				DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
-				krb5_set_real_time(gensec_krb5_state->context, t + time_offset + 1, 0);
-				break;
-			}
-	
-			if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
-				DEBUG(1,("kinit for %s failed (%s)\n", 
-					 cli_credentials_get_principal(gensec_security->credentials, gensec_krb5_state), 
-					 error_message(ret)));
-				return NT_STATUS_TIME_DIFFERENCE_AT_DC;
-			}
-			if (ret) {
-				DEBUG(1,("kinit for %s failed (%s)\n", 
-					 cli_credentials_get_principal(gensec_security->credentials, gensec_krb5_state), 
-					 error_message(ret)));
-				return NT_STATUS_WRONG_PASSWORD;
-			}
-			break;
+		nt_status = kinit_to_ccache(gensec_krb5_state,  
+					    gensec_security->credentials,
+					    gensec_krb5_state->context, 
+					    &gensec_krb5_state->ccache, 
+					    &ccache_name);
+		
+		if (!NT_STATUS_IS_OK(nt_status)) {
+			return nt_status;
 		}
+		break;
+
 		default:
 			DEBUG(0, ("kerberos: %s\n", 
-				  error_message(ret)));
+				  smb_get_krb5_error_message(gensec_krb5_state->context, ret, gensec_krb5_state)));
 			return NT_STATUS_UNSUCCESSFUL;
 		}
 	}
@@ -474,7 +443,7 @@ static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 	{
 		if (ret) {
 			DEBUG(1,("ads_krb5_mk_req (request ticket) failed (%s)\n",
-				 error_message(ret)));
+				 smb_get_krb5_error_message(gensec_krb5_state->context, ret, out_mem_ctx)));
 			nt_status = NT_STATUS_LOGON_FAILURE;
 		} else {
 			DATA_BLOB unwrapped_out;
@@ -515,7 +484,7 @@ static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
 				  &inbuf, &repl);
 		if (ret) {
 			DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
-				 error_message(ret)));
+				 smb_get_krb5_error_message(gensec_krb5_state->context, ret, out_mem_ctx)));
 			dump_data_pw("Mutual authentication message:\n", inbuf.data, inbuf.length);
 			nt_status = NT_STATUS_ACCESS_DENIED;
 		} else {
@@ -707,24 +676,16 @@ static BOOL gensec_krb5_have_feature(struct gensec_security *gensec_security,
 	return False;
 }
 
+static const char *gensec_krb5_oids[] = { 
+	GENSEC_OID_KERBEROS5,
+	GENSEC_OID_KERBEROS5_OLD,
+	NULL 
+};
 
 static const struct gensec_security_ops gensec_krb5_security_ops = {
 	.name		= "krb5",
 	.auth_type	= DCERPC_AUTH_TYPE_KRB5,
-	.oid            = GENSEC_OID_KERBEROS5,
-	.client_start   = gensec_krb5_client_start,
-	.server_start   = gensec_krb5_server_start,
-	.update 	= gensec_krb5_update,
-	.session_key	= gensec_krb5_session_key,
-	.session_info	= gensec_krb5_session_info,
-	.have_feature   = gensec_krb5_have_feature,
-	.enabled        = False
-};
-
-static const struct gensec_security_ops gensec_ms_krb5_security_ops = {
-	.name		= "ms_krb5",
-	.auth_type	= DCERPC_AUTH_TYPE_KRB5,
-	.oid            = GENSEC_OID_KERBEROS5_OLD,
+	.oid            = gensec_krb5_oids,
 	.client_start   = gensec_krb5_client_start,
 	.server_start   = gensec_krb5_server_start,
 	.update 	= gensec_krb5_update,
@@ -734,7 +695,6 @@ static const struct gensec_security_ops gensec_ms_krb5_security_ops = {
 	.enabled        = False
 };
 
-
 NTSTATUS gensec_krb5_init(void)
 {
 	NTSTATUS ret;
@@ -746,12 +706,5 @@ NTSTATUS gensec_krb5_init(void)
 		return ret;
 	}
 
-	ret = gensec_register(&gensec_ms_krb5_security_ops);
-	if (!NT_STATUS_IS_OK(ret)) {
-		DEBUG(0,("Failed to register '%s' gensec backend!\n",
-			gensec_krb5_security_ops.name));
-		return ret;
-	}
-
 	return ret;
 }
diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index 3d9dbfb1e7..f5d1dd2238 100644
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -43,6 +43,8 @@ struct spnego_state {
 	enum spnego_state_position state_position;
 	struct gensec_security *sub_sec_security;
 	BOOL no_response_expected;
+
+	const char *neg_oid;
 };
 
 
@@ -247,15 +249,23 @@ static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec
 						  TALLOC_CTX *out_mem_ctx, 
 						  const DATA_BLOB in, DATA_BLOB *out) 
 {
-	int i;
+	int i,j;
 	int num_ops;
 	const struct gensec_security_ops **all_ops = gensec_security_all(&num_ops);
 	for (i=0; i < num_ops; i++) {
+		BOOL is_spnego;
 		NTSTATUS nt_status;
 		if (!all_ops[i]->oid) {
 			continue;
 		}
-		if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid) == 0) {
+
+		is_spnego = False;
+		for (j=0; all_ops[i]->oid[j]; j++) {
+			if (strcasecmp(GENSEC_OID_SPNEGO,all_ops[i]->oid[j]) == 0) {
+				is_spnego = True;
+			}
+		}
+		if (is_spnego) {
 			continue;
 		}
 
@@ -266,15 +276,15 @@ static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec
 			return nt_status;
 		}
 		/* select the sub context */
-		nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
-						     all_ops[i]->oid);
+		nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
+						     all_ops[i]);
 		if (!NT_STATUS_IS_OK(nt_status)) {
 			talloc_free(spnego_state->sub_sec_security);
 			spnego_state->sub_sec_security = NULL;
 			continue;
 		}
 		nt_status = gensec_update(spnego_state->sub_sec_security,
-							  out_mem_ctx, in, out);
+					  out_mem_ctx, in, out);
 		if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 			spnego_state->state_position = SPNEGO_FALLBACK;
 			return nt_status;
@@ -288,84 +298,41 @@ static NTSTATUS gensec_spnego_server_try_fallback(struct gensec_security *gensec
 }
 
 /* 
-   Parse the netTokenInit from the client, to the server.  
-
-   
+   Parse the netTokenInit, either from the client, to the server, or
+   from the server to the client.
 */
 
-static NTSTATUS gensec_spnego_server_parse_negTokenInit(struct gensec_security *gensec_security,
-							struct spnego_state *spnego_state, 
-							TALLOC_CTX *out_mem_ctx, 
-							const char **mechType,
-							const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out) 
-{
-	NTSTATUS nt_status;
-
-	if (!mechType || !mechType[0]) {
-		DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-
-	nt_status = gensec_subcontext_start(spnego_state,
-					    gensec_security,
-					    &spnego_state->sub_sec_security);
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		return nt_status;
-	}
-	/* select the sub context */
-	nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
-					     mechType[0]);
-	if (!NT_STATUS_IS_OK(nt_status)) {
-		talloc_free(spnego_state->sub_sec_security);
-		spnego_state->sub_sec_security = NULL;
-		return nt_status;
-	}
-
-	if (!unwrapped_in.length) {
-		return NT_STATUS_INVALID_PARAMETER;
-	}
-		
-	nt_status = gensec_update(spnego_state->sub_sec_security,
-				  out_mem_ctx, 
-				  unwrapped_in,
-				  unwrapped_out);
-
-	if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
-		DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n", 
-			  spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
-		talloc_free(spnego_state->sub_sec_security);
-		spnego_state->sub_sec_security = NULL;
-	}
-	return nt_status;
-}
-
-static NTSTATUS gensec_spnego_client_parse_negTokenInit(struct gensec_security *gensec_security,
-							struct spnego_state *spnego_state, 
-							TALLOC_CTX *out_mem_ctx, 
-							const char **mechType,
-							const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out) 
+static NTSTATUS gensec_spnego_parse_negTokenInit(struct gensec_security *gensec_security,
+						 struct spnego_state *spnego_state, 
+						 TALLOC_CTX *out_mem_ctx, 
+						 const char **mechType,
+						 const DATA_BLOB unwrapped_in, DATA_BLOB *unwrapped_out) 
 {
 	int i;
-	NTSTATUS nt_status;
+	NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 	DATA_BLOB null_data_blob = data_blob(NULL,0);
 
-	for (i=0; mechType && mechType[i]; i++) {
+	const struct gensec_security_ops_wrapper *all_sec
+		= gensec_security_by_oid_list(out_mem_ctx, 
+					      mechType,
+					      GENSEC_OID_SPNEGO);
+	for (i=0; all_sec && all_sec[i].op; i++) {
 		nt_status = gensec_subcontext_start(spnego_state,
 						    gensec_security,
 						    &spnego_state->sub_sec_security);
 		if (!NT_STATUS_IS_OK(nt_status)) {
-			break;
+			return nt_status;
 		}
 		/* select the sub context */
-		nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
-						     mechType[i]);
+		nt_status = gensec_start_mech_by_ops(spnego_state->sub_sec_security,
+						     all_sec[i].op);
 		if (!NT_STATUS_IS_OK(nt_status)) {
 			talloc_free(spnego_state->sub_sec_security);
 			spnego_state->sub_sec_security = NULL;
 			continue;
 		}
-		
-		if (i == 0) {
+
+		if ((i == 0) && (strcmp(all_sec[0].oid, mechType[0]) == 0)) {
 			nt_status = gensec_update(spnego_state->sub_sec_security,
 						  out_mem_ctx, 
 						  unwrapped_in,
@@ -376,20 +343,51 @@ static NTSTATUS gensec_spnego_client_parse_negTokenInit(struct gensec_security *
 						  out_mem_ctx, 
 						  null_data_blob, 
 						  unwrapped_out);
+			/* it is likely that a NULL input token will
+			 * not be liked by most mechs, so just push us
+			 * along the merry-go-round again, and hope
+			 * for better luck next time */
+
+			if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
+				nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+			}
 		}
-		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
+			
+		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) 
+		    && !NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) 
+		    && !NT_STATUS_IS_OK(nt_status)) {
 			DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n", 
 				  spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 			talloc_free(spnego_state->sub_sec_security);
 			spnego_state->sub_sec_security = NULL;
-			/* If the mech failed on first packet generation, pretend it never actually started */
+
+			/* We started the mech correctly, and the
+			 * input from the other side was valid.
+			 * Return the error (say bad password, invalid
+			 * ticket) */
+			return nt_status;
+
+		} else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
+			/* Pretend we never started it (lets the first run find some incompatible demand) */
+
+			DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed to parse: %s\n", 
+				  spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
+			talloc_free(spnego_state->sub_sec_security);
+			spnego_state->sub_sec_security = NULL;
 			continue;
 		}
-		return nt_status;
-	}
-	if (!mechType || !mechType[i]) {
-		DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
+
+		spnego_state->neg_oid = all_sec[i].oid;
+
+		return nt_status; /* OK, INVALID_PARAMETER ore MORE PROCESSING */
 	}
+
+	DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
+	/* we could re-negotiate here, but it would only work
+	 * if the client or server lied about what it could
+	 * support the first time.  Lets keep this code to
+	 * reality */
+
 	return NT_STATUS_INVALID_PARAMETER;
 }
 
@@ -403,10 +401,10 @@ static NTSTATUS gensec_spnego_client_negTokenInit(struct gensec_security *gensec
 						  TALLOC_CTX *out_mem_ctx, 
 						  const DATA_BLOB in, DATA_BLOB *out) 
 {
-	DATA_BLOB null_data_blob = data_blob(NULL,0);
+	DATA_BLOB null_data_blob = data_blob(NULL, 0);
 	NTSTATUS nt_status;
 	const char **mechTypes = NULL;
-	DATA_BLOB unwrapped_out = data_blob(NULL,0);
+	DATA_BLOB unwrapped_out = data_blob(NULL, 0);
 
 	mechTypes = gensec_security_oids(out_mem_ctx, GENSEC_OID_SPNEGO);
 
@@ -482,52 +480,16 @@ static NTSTATUS gensec_spnego_server_negTokenTarg(struct gensec_security *gensec
 	spnego_out.negTokenTarg.mechListMIC = null_data_blob;
 	spnego_out.negTokenTarg.supportedMech = NULL;
 
-	if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-		spnego_out.negTokenTarg.supportedMech
-			= spnego_state->sub_sec_security->ops->oid;
+	if (NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {	
+		spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
 		spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
 		spnego_state->state_position = SPNEGO_SERVER_TARG;
 	} else if (NT_STATUS_IS_OK(nt_status)) {
 		if (unwrapped_out.data) {
-			spnego_out.negTokenTarg.supportedMech
-				= spnego_state->sub_sec_security->ops->oid;
+			spnego_out.negTokenTarg.supportedMech = spnego_state->neg_oid;
 		}
 		spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_COMPLETED;
 		spnego_state->state_position = SPNEGO_DONE;
-	} else if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER)) {
-		if (spnego_state->sub_sec_security) {
-			/* we have a mech, but we just didn't get the input parameter */
-			spnego_out.negTokenTarg.supportedMech
-				= spnego_state->sub_sec_security->ops->oid;
-		} else {
-			const char **mechTypes = gensec_security_oids(out_mem_ctx, GENSEC_OID_SPNEGO);
-			if (!mechTypes) {
-				DEBUG(1, ("no GENSEC OID backends available\n"));
-				return NT_STATUS_INVALID_PARAMETER;
-			}
-
-			nt_status = gensec_subcontext_start(spnego_state, 
-							    gensec_security, 
-							    &spnego_state->sub_sec_security);
-			if (!NT_STATUS_IS_OK(nt_status)) {
-				return nt_status;
-			}
-			/* select our preferred mech */
-			nt_status = gensec_start_mech_by_oid(spnego_state->sub_sec_security,
-							     mechTypes[0]);
-			if (!NT_STATUS_IS_OK(nt_status)) {
-				talloc_free(spnego_state->sub_sec_security);
-				spnego_state->sub_sec_security = NULL;
-				return nt_status;
-			}
-
-			/* we should be sending the whole list here */
-			spnego_out.negTokenTarg.supportedMech = mechTypes[0];
-		}
-			
-		spnego_out.negTokenTarg.negResult = SPNEGO_ACCEPT_INCOMPLETE;
-		spnego_state->state_position = SPNEGO_SERVER_TARG;
-		nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
 	} else {
 		spnego_out.negTokenTarg.negResult = SPNEGO_REJECT;
 		DEBUG(2, ("SPNEGO login failed: %s\n", nt_errstr(nt_status)));
@@ -588,7 +550,7 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
 				return NT_STATUS_INVALID_PARAMETER;
 			}
 			
-			nt_status = gensec_spnego_server_parse_negTokenInit(gensec_security,
+			nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
 								     spnego_state,
 								     out_mem_ctx, 
 								     spnego.negTokenInit.mechTypes,
@@ -613,7 +575,7 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
 			spnego_out.negTokenInit.reqFlags = 0;
 			spnego_out.negTokenInit.mechListMIC
 				= data_blob_string_const(talloc_asprintf(out_mem_ctx, "%s$@%s", lp_netbios_name(), lp_realm()));
-			spnego_out.negTokenInit.mechToken = unwrapped_out;
+			spnego_out.negTokenInit.mechToken = data_blob(NULL, 0);
 			
 			if (spnego_write_data(out_mem_ctx, out, &spnego_out) == -1) {
 				DEBUG(1, ("Failed to write SPNEGO reply to NEG_TOKEN_INIT\n"));
@@ -662,7 +624,7 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
 			DEBUG(5, ("Server claims it's principal name is %s (ignored)\n", spnego.negTokenInit.targetPrincipal));
 		}
 
-		nt_status = gensec_spnego_client_parse_negTokenInit(gensec_security,
+		nt_status = gensec_spnego_parse_negTokenInit(gensec_security,
 							     spnego_state,
 							     out_mem_ctx, 
 							     spnego.negTokenInit.mechTypes,
@@ -674,9 +636,8 @@ static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TA
 			return nt_status;
 		}
 
+		my_mechs[0] = spnego_state->neg_oid;
 		/* compose reply */
-		my_mechs[0] = spnego_state->sub_sec_security->ops->oid;
-		
 		spnego_out.type = SPNEGO_NEG_TOKEN_INIT;
 		spnego_out.negTokenInit.mechTypes = my_mechs;
 		spnego_out.negTokenInit.reqFlags = 0;
@@ -851,11 +812,16 @@ static BOOL gensec_spnego_have_feature(struct gensec_security *gensec_security,
 				   feature);
 }
 
+static const char *gensec_spnego_oids[] = { 
+	GENSEC_OID_SPNEGO,
+	NULL 
+};
+
 static const struct gensec_security_ops gensec_spnego_security_ops = {
 	.name		= "spnego",
 	.sasl_name	= "GSS-SPNEGO",
 	.auth_type	= DCERPC_AUTH_TYPE_SPNEGO,
-	.oid            = GENSEC_OID_SPNEGO,
+	.oid            = gensec_spnego_oids,
 	.client_start   = gensec_spnego_client_start,
 	.server_start   = gensec_spnego_server_start,
 	.update 	= gensec_spnego_update,
diff --git a/source4/auth/kerberos/kerberos.h b/source4/auth/kerberos/kerberos.h
index 4daf0ea07a..ec7df4c2f1 100644
--- a/source4/auth/kerberos/kerberos.h
+++ b/source4/auth/kerberos/kerberos.h
@@ -95,5 +95,10 @@ BOOL kerberos_compatible_enctypes(krb5_context context, krb5_enctype enctype1, k
 void kerberos_free_data_contents(krb5_context context, krb5_data *pdata);
 krb5_error_code smb_krb5_kt_free_entry(krb5_context context, krb5_keytab_entry *kt_entry);
 char *smb_get_krb5_error_message(krb5_context context, krb5_error_code code, TALLOC_CTX *mem_ctx);
+NTSTATUS kinit_to_ccache(TALLOC_CTX *parent_ctx,
+			 struct cli_credentials *credentials,
+			 krb5_context context,
+			 krb5_ccache *ccache,
+			 const char **ccache_name);
 #endif /* HAVE_KRB5 */
 
diff --git a/source4/auth/kerberos/kerberos.mk b/source4/auth/kerberos/kerberos.mk
index a43e6bb517..38c8862747 100644
--- a/source4/auth/kerberos/kerberos.mk
+++ b/source4/auth/kerberos/kerberos.mk
@@ -5,6 +5,7 @@ INIT_OBJ_FILES = auth/kerberos/kerberos.o
 ADD_OBJ_FILES = \
 		auth/kerberos/clikrb5.o \
 		auth/kerberos/kerberos_verify.o \
+		auth/kerberos/kerberos_util.o \
 		auth/kerberos/gssapi_parse.o
 # End SUBSYSTEM KERBEROS
 #################################
diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
new file mode 100644
index 0000000000..55975b2594
--- /dev/null
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -0,0 +1,120 @@
+/* 
+   Unix SMB/CIFS implementation.
+
+   Kerberos utility functions for GENSEC
+   
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 2 of the License, or
+   (at your option) any later version.
+   
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   
+   You should have received a copy of the GNU General Public License
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#include "includes.h"
+#include "system/kerberos.h"
+#include "system/time.h"
+#include "system/network.h"
+#include "auth/kerberos/kerberos.h"
+#include "auth/auth.h"
+
+struct ccache_container {
+	krb5_context krb5_context;
+	krb5_ccache ccache;
+} ccache_container;
+
+#if 0
+static int free_ccache(void *ptr) {
+	struct ccache_container *ccc = ptr;
+	/* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
+	krb5_cc_close(ccc->krb5_context, ccc->ccache);
+
+	return 0;
+}
+#endif
+
+/**
+ * Return a freshly allocated ccache (destroyed by destructor on child
+ * of parent_ctx), for a given set of client credentials 
+ */
+
+ NTSTATUS kinit_to_ccache(TALLOC_CTX *parent_ctx,
+			  struct cli_credentials *credentials,
+			  krb5_context context,
+			  krb5_ccache *ccache,
+			  const char **ccache_name) 
+{
+	krb5_error_code ret;
+	const char *password;
+	char *ccache_string;
+	time_t kdc_time = 0;
+	struct ccache_container *mem_ctx = talloc(parent_ctx, struct ccache_container);
+
+	if (!mem_ctx) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	password = cli_credentials_get_password(credentials);
+	
+	/* this string should be unique */
+	ccache_string = talloc_asprintf(mem_ctx, "MEMORY:%s_%s", 
+					cli_credentials_get_principal(credentials, mem_ctx), 
+					generate_random_str(mem_ctx, 16));
+	
+	ret = krb5_cc_resolve(context, ccache_string, ccache);
+	if (ret) {
+		DEBUG(1,("failed to generate a new krb5 keytab (%s): %s\n", 
+			 ccache_string,
+			 error_message(ret)));
+		talloc_free(mem_ctx);
+		return NT_STATUS_INTERNAL_ERROR;
+	}
+
+	mem_ctx->krb5_context = context;
+	mem_ctx->ccache = *ccache;
+
+#if 0
+	talloc_set_destructor(mem_ctx, free_ccache);
+#endif
+	ret = kerberos_kinit_password_cc(context, *ccache, 
+					 cli_credentials_get_principal(credentials, mem_ctx), 
+					 password, NULL, &kdc_time);
+	
+	/* cope with ticket being in the future due to clock skew */
+	if ((unsigned)kdc_time > time(NULL)) {
+		time_t t = time(NULL);
+		int time_offset =(unsigned)kdc_time-t;
+		DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
+		krb5_set_real_time(context, t + time_offset + 1, 0);
+	}
+	
+	if (ret == KRB5KRB_AP_ERR_SKEW || ret == KRB5_KDCREP_SKEW) {
+		DEBUG(1,("kinit for %s failed (%s)\n", 
+			 cli_credentials_get_principal(credentials, mem_ctx), 
+			 smb_get_krb5_error_message(context, 
+						    ret, mem_ctx)));
+		talloc_free(mem_ctx);
+		return NT_STATUS_TIME_DIFFERENCE_AT_DC;
+	}
+	if (ret) {
+		DEBUG(1,("kinit for %s failed (%s)\n", 
+			 cli_credentials_get_principal(credentials, mem_ctx), 
+			 smb_get_krb5_error_message(context, 
+						    ret, mem_ctx)));
+		talloc_free(mem_ctx);
+		return NT_STATUS_WRONG_PASSWORD;
+	} 
+	*ccache_name = ccache_string;
+
+	return NT_STATUS_OK;
+}
diff --git a/source4/auth/kerberos/kerberos_verify.c b/source4/auth/kerberos/kerberos_verify.c
index 927b12d454..0497e3effa 100644
--- a/source4/auth/kerberos/kerberos_verify.c
+++ b/source4/auth/kerberos/kerberos_verify.c
@@ -93,7 +93,8 @@ static krb5_error_code ads_keytab_verify_ticket(TALLOC_CTX *mem_ctx, krb5_contex
 
 	/* Generate the list of principal names which we expect
 	 * clients might want to use for authenticating to the file
-	 * service.  We allow name$,{host,cifs}/{name,fqdn,name.REALM}. */
+	 * service.  We allow name$,{host,service}/{name,fqdn,name.REALM}.
+	 * (where service is specified by the caller) */
 
 	my_name = lp_netbios_name();
 
@@ -103,9 +104,9 @@ static krb5_error_code ads_keytab_verify_ticket(TALLOC_CTX *mem_ctx, krb5_contex
 	asprintf(&valid_princ_formats[1], "host/%s@%s", my_name, lp_realm());
 	asprintf(&valid_princ_formats[2], "host/%s@%s", my_fqdn, lp_realm());
 	asprintf(&valid_princ_formats[3], "host/%s.%s@%s", my_name, lp_realm(), lp_realm());
-	asprintf(&valid_princ_formats[4], "cifs/%s@%s", my_name, lp_realm());
-	asprintf(&valid_princ_formats[5], "cifs/%s@%s", my_fqdn, lp_realm());
-	asprintf(&valid_princ_formats[6], "cifs/%s.%s@%s", my_name, lp_realm(), lp_realm());
+	asprintf(&valid_princ_formats[4], "%s/%s@%s", service, my_name, lp_realm());
+	asprintf(&valid_princ_formats[5], "%s/%s@%s", service, my_fqdn, lp_realm());
+	asprintf(&valid_princ_formats[6], "%s/%s.%s@%s", service, my_name, lp_realm(), lp_realm());
 
 	ZERO_STRUCT(kt_entry);
 	ZERO_STRUCT(kt_cursor);
diff --git a/source4/auth/ntlmssp/ntlmssp.c b/source4/auth/ntlmssp/ntlmssp.c
index ac007ae3ab..a8c5828295 100644
--- a/source4/auth/ntlmssp/ntlmssp.c
+++ b/source4/auth/ntlmssp/ntlmssp.c
@@ -325,11 +325,16 @@ NTSTATUS gensec_ntlmssp_start(struct gensec_security *gensec_security)
 	return NT_STATUS_OK;
 }
 
+static const char *gensec_ntlmssp_oids[] = { 
+	GENSEC_OID_NTLMSSP, 
+	NULL
+};
+
 static const struct gensec_security_ops gensec_ntlmssp_security_ops = {
 	.name		= "ntlmssp",
 	.sasl_name	= "NTLM",
 	.auth_type	= DCERPC_AUTH_TYPE_NTLMSSP,
-	.oid            = GENSEC_OID_NTLMSSP,
+	.oid            = gensec_ntlmssp_oids,
 	.client_start   = gensec_ntlmssp_client_start,
 	.server_start   = gensec_ntlmssp_server_start,
 	.update 	= gensec_ntlmssp_update,
diff --git a/source4/include/structs.h b/source4/include/structs.h
index 8204cb769d..4b20559f90 100644
--- a/source4/include/structs.h
+++ b/source4/include/structs.h
@@ -72,6 +72,7 @@ struct auth_methods;
 struct schannel_state;
 struct spnego_data;
 struct gensec_security;
+struct gensec_security_ops;
 typedef NTSTATUS (*gensec_password_callback)(struct gensec_security *gensec_security, TALLOC_CTX *mem_ctx, 
 					     char **password);
 struct gensec_ntlmssp_state;