r6792: Allow a mech to fail on the first pass at the packet, and still fall

back to the other options.

Andrew Bartlett

diff --git a/source/auth/gensec/spnego.c b/source/auth/gensec/spnego.c
index 4d9d1248073f3d361dd55dc1c7addeae5b5dea2b..3d9dbfb1e7f973ec8cacb11e96dce40d8ccddbef 100644 (file)
--- a/source/auth/gensec/spnego.c
+++ b/source/auth/gensec/spnego.c
@@ -382,6 +382,8 @@ static NTSTATUS gensec_spnego_client_parse_negTokenInit(struct gensec_security *
                                  spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
                        talloc_free(spnego_state->sub_sec_security);
                        spnego_state->sub_sec_security = NULL;
+                       /* If the mech failed on first packet generation, pretend it never actually started */
+                       continue;
                }
                return nt_status;
        }