Removed global_myworkgroup, global_myname, global_myscope. Added liberal

[samba.git] / source3 / libads / sasl.c

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index c110c1d2cd7d15b19dd8c494a8784cff1af51e24..7aa77bf2a240405251323fd24561777d9a00fd77 100644 (file)
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -20,7 +20,7 @@
 
 #include "includes.h"
 
-#ifdef HAVE_ADS
+#ifdef HAVE_LDAP
 
 /* 
    perform a LDAP/SASL/SPNEGO/NTLMSSP bind (just how many layers can
@@ -36,9 +36,13 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
        uint32 neg_flags;
        struct berval cred, *scred;
        ADS_STATUS status;
-       extern pstring global_myname;
        int rc;
 
+       if (!ads->auth.password) {
+               /* No password, don't segfault below... */
+               return ADS_ERROR_NT(NT_STATUS_LOGON_FAILURE);
+       }
+
        neg_flags = NTLMSSP_NEGOTIATE_UNICODE | 
                NTLMSSP_NEGOTIATE_128 | 
                NTLMSSP_NEGOTIATE_NTLM;
@@ -92,7 +96,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
                  nthash, 24,
                  lp_workgroup(), 
                  ads->auth.user_name, 
-                 global_myname,
+                 global_myname(),
                  sess_key, 16,
                  neg_flags);
 
@@ -185,10 +189,19 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
        }
        DEBUG(3,("got principal=%s\n", principal));
 
+#ifdef HAVE_KRB5
        if (!(ads->auth.flags & ADS_AUTH_DISABLE_KERBEROS) &&
-           got_kerberos_mechanism && ads_kinit_password(ads) == 0) {
-               return ads_sasl_spnego_krb5_bind(ads, principal);
+           got_kerberos_mechanism) {
+               status = ads_sasl_spnego_krb5_bind(ads, principal);
+               if (ADS_ERR_OK(status))
+                       return status;
+               if (ads_kinit_password(ads) == 0) {
+                       status = ads_sasl_spnego_krb5_bind(ads, principal);
+               }
+               if (ADS_ERR_OK(status))
+                       return status;
        }
+#endif
 
        /* lets do NTLMSSP ... this has the big advantage that we don't need
           to sync clocks, and we don't rely on special versions of the krb5