+
+ if (pw) {
+ /* if a real user check pam account restrictions */
+ /* only really perfomed if "obey pam restriction" is true */
+ /* do this before an eventual mappign to guest occurs */
+ ret = smb_pam_accountcheck(pw->pw_name);
+ if ( !NT_STATUS_IS_OK(ret)) {
+ DEBUG(1, ("PAM account restriction prevents user login\n"));
+ data_blob_free(&ap_rep);
+ data_blob_free(&session_key);
+ talloc_destroy(mem_ctx);
+ TALLOC_FREE(pw);
+ return ERROR_NT(nt_status_squash(ret));
+ }
+ }
+