r24804: As a temporary workaround, also try to guess the server's principal in the

"not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds
succeed with windows server 2008.

Guenther

diff --git a/source/include/ads.h b/source/include/ads.h
index 0216f536c98b8654cc48bcdfff07c9685acda9b1..37d09f1e4261a1a69241d07e2522924ccfcf2831 100644 (file)
--- a/source/include/ads.h
+++ b/source/include/ads.h
@@ -394,4 +394,6 @@ typedef struct {
 
 #define ADS_EXTENDED_RIGHT_APPLY_GROUP_POLICY "edacfd8f-ffb3-11d1-b41d-00a0c968f939"
 
+#define ADS_IGNORE_PRINCIPAL "not_defined_in_RFC4178@please_ignore"
+
 #endif /* _INCLUDE_ADS_H_ */

diff --git a/source/libads/sasl.c b/source/libads/sasl.c
index fb4fb2132dfe57d592c9162150fdb78ebc6c7c9c..3752d3c2ac211d3d1ff0d75058f9e293b0d74a03 100644 (file)
--- a/source/libads/sasl.c
+++ b/source/libads/sasl.c
@@ -657,52 +657,23 @@ static ADS_STATUS ads_generate_service_principal(ADS_STRUCT *ads,
 
        ZERO_STRUCTP(p);
 
-       /* I've seen a child Windows 2000 domain not send 
-          the principal name back in the first round of 
+       /* I've seen a child Windows 2000 domain not send
+          the principal name back in the first round of
           the SASL bind reply.  So we guess based on server
           name and realm.  --jerry  */
-       if (given_principal) {
-               p->string = SMB_STRDUP(given_principal);
-               if (!p->string) {
-                       return ADS_ERROR(LDAP_NO_MEMORY);
-               }
-       } else if (ads->server.realm && ads->server.ldap_server) {
-               char *server, *server_realm;
-
-               server = SMB_STRDUP(ads->server.ldap_server);
-               server_realm = SMB_STRDUP(ads->server.realm);
-
-               if (!server || !server_realm) {
-                       return ADS_ERROR(LDAP_NO_MEMORY);
-               }
-
-               strlower_m(server);
-               strupper_m(server_realm);
-               asprintf(&p->string, "ldap/%s@%s", server, server_realm);
-
-               SAFE_FREE(server);
-               SAFE_FREE(server_realm);
-
-               if (!p->string) {
-                       return ADS_ERROR(LDAP_NO_MEMORY);
-               }
-       } else if (ads->config.realm && ads->config.ldap_server_name) {
-               char *server, *server_realm;
+       /* Also try best guess when we get the w2k8 ignore
+          principal back - gd */
 
-               server = SMB_STRDUP(ads->config.ldap_server_name);
-               server_realm = SMB_STRDUP(ads->config.realm);
+       if (!given_principal ||
+           strequal(given_principal, ADS_IGNORE_PRINCIPAL)) {
 
-               if (!server || !server_realm) {
-                       return ADS_ERROR(LDAP_NO_MEMORY);
+               status = ads_guess_service_principal(ads, given_principal,
+                                                    &p->string);
+               if (!ADS_ERR_OK(status)) {
+                       return status;
                }
-
-               strlower_m(server);
-               strupper_m(server_realm);
-               asprintf(&p->string, "ldap/%s@%s", server, server_realm);
-
-               SAFE_FREE(server);
-               SAFE_FREE(server_realm);
-
+       } else {
+               p->string = SMB_STRDUP(given_principal);
                if (!p->string) {
                        return ADS_ERROR(LDAP_NO_MEMORY);
                }

diff --git a/source/libads/util.c b/source/libads/util.c
index 2fb9fa81b458698b45b4fddd5a45511a891ab4d9..a0c9d8f4c4b1db516e030986f3efc39ef9f22403 100644 (file)
--- a/source/libads/util.c
+++ b/source/libads/util.c
@@ -51,4 +51,62 @@ failed:
        SAFE_FREE(password);
        return ret;
 }
+
+ADS_STATUS ads_guess_service_principal(ADS_STRUCT *ads,
+                                      const char *given_principal,
+                                      char **returned_principal)
+{
+       char *princ = NULL;
+
+       if (ads->server.realm && ads->server.ldap_server) {
+               char *server, *server_realm;
+
+               server = SMB_STRDUP(ads->server.ldap_server);
+               server_realm = SMB_STRDUP(ads->server.realm);
+
+               if (!server || !server_realm) {
+                       return ADS_ERROR(LDAP_NO_MEMORY);
+               }
+
+               strlower_m(server);
+               strupper_m(server_realm);
+               asprintf(&princ, "ldap/%s@%s", server, server_realm);
+
+               SAFE_FREE(server);
+               SAFE_FREE(server_realm);
+
+               if (!princ) {
+                       return ADS_ERROR(LDAP_NO_MEMORY);
+               }
+       } else if (ads->config.realm && ads->config.ldap_server_name) {
+               char *server, *server_realm;
+
+               server = SMB_STRDUP(ads->config.ldap_server_name);
+               server_realm = SMB_STRDUP(ads->config.realm);
+
+               if (!server || !server_realm) {
+                       return ADS_ERROR(LDAP_NO_MEMORY);
+               }
+
+               strlower_m(server);
+               strupper_m(server_realm);
+               asprintf(&princ, "ldap/%s@%s", server, server_realm);
+
+               SAFE_FREE(server);
+               SAFE_FREE(server_realm);
+
+               if (!princ) {
+                       return ADS_ERROR(LDAP_NO_MEMORY);
+               }
+       }
+
+       if (!princ) {
+               return ADS_ERROR(LDAP_PARAM_ERROR);
+       }
+
+       *returned_principal = princ;
+
+       return ADS_SUCCESS;
+}
+
 #endif