auth: Pass though error from GENSEC sub-mechanism

This allows wrong-password or account-locked-out errors to be passed
though from Kerberos (gssapi).

Andrew Bartlett

Change-Id: I4bc11a1ad98dfbcc5a4ad9101cd843a7a59f0b59
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c
index 7e9dcaee70c67cc5689c67bd1a9e9be14edf9e25..20cacdb9b451d477a2bf486d11d09de0b4956525 100644 (file)
--- a/auth/gensec/spnego.c
+++ b/auth/gensec/spnego.c
@@ -705,7 +705,7 @@ static NTSTATUS gensec_spnego_create_negTokenInit(struct gensec_security *gensec
        spnego_state->sub_sec_security = NULL;
 
        DEBUG(1, ("Failed to setup SPNEGO negTokenInit request: %s\n", nt_errstr(nt_status)));
-       return NT_STATUS_INVALID_PARAMETER;
+       return nt_status;
 }