s3-auth: Order GENSEC mechs by priority, krb5 before NTLMSSP

Otherwise, really simple clients (such as the current ntlm_auth gss-spnego client)
will not select krb5.

Andrew Bartlett

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index f99d390edd118ece4ac26261d6b9ebe3890d9733..c37672620f46eef0256d84d0e376fb4dbb77c5db 100644 (file)
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -292,12 +292,13 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
 
                gensec_init();
 
-               gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
-
+               /* These need to be in priority order, krb5 before NTLMSSP */
 #if defined(HAVE_KRB5)
                gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 #endif
 
+               gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
                gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
                                                        GENSEC_OID_SPNEGO);
 

diff --git a/source3/libsmb/auth_generic.c b/source3/libsmb/auth_generic.c
index dbd87fff2bcafedb698614627a435508d9c6a865..f1510d2e90a9c91f96615382398ac8a43023cc4b 100644 (file)
--- a/source3/libsmb/auth_generic.c
+++ b/source3/libsmb/auth_generic.c
@@ -83,13 +83,15 @@ NTSTATUS auth_generic_client_prepare(TALLOC_CTX *mem_ctx, struct auth_generic_st
                return NT_STATUS_NO_MEMORY;
        }
 
-       gensec_settings->backends[idx++] = &gensec_ntlmssp3_client_ops;
+       gensec_init();
 
+       /* These need to be in priority order, krb5 before NTLMSSP */
 #if defined(HAVE_KRB5)
        gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 #endif
 
-       gensec_init();
+       gensec_settings->backends[idx++] = &gensec_ntlmssp3_client_ops;
+
        gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
                                                GENSEC_OID_SPNEGO);
 

diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
index bc3535920b9169cd3ec2e1c525accd039ae33607..51ea0973532d6c3e3b8e71a8571790529f228784 100644 (file)
--- a/source3/utils/ntlm_auth.c
+++ b/source3/utils/ntlm_auth.c
@@ -1130,12 +1130,13 @@ static NTSTATUS ntlm_auth_start_ntlmssp_server(TALLOC_CTX *mem_ctx,
        
        gensec_init();
        
-       gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
-       
+       /* These need to be in priority order, krb5 before NTLMSSP */
 #if defined(HAVE_KRB5)
        gensec_settings->backends[idx++] = &gensec_gse_krb5_security_ops;
 #endif
        
+       gensec_settings->backends[idx++] = gensec_security_by_oid(NULL, GENSEC_OID_NTLMSSP);
+
        gensec_settings->backends[idx++] = gensec_security_by_oid(NULL,
                                                                  GENSEC_OID_SPNEGO);