r23052: sync with SAMBA_3_0_25 and start updating release notes

[jpeach/samba.git] / source / nsswitch / winbindd_pam.c

diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index 6ee548292ccf6d2342e3c47db4c2f0ddc735546b..589f4839e0bfb9c8c58af53d6050c71fe1313f4e 100644 (file)
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -288,7 +288,7 @@ struct winbindd_domain *find_auth_domain(struct winbindd_cli_state *state,
                } else {
                        return domain;
                } 
-               }
+       }
 
        return find_our_domain();
 }
@@ -579,6 +579,14 @@ static NTSTATUS winbindd_raw_kerberos_login(struct winbindd_domain *domain,
                http_timestring(ticket_lifetime), (int)ticket_lifetime, 
                http_timestring(renewal_until), (int)renewal_until));
 
+       /* we cannot continue with krb5 when UF_DONT_REQUIRE_PREAUTH is set,
+        * in that case fallback to NTLM - gd */ 
+
+       if ((ticket_lifetime == 0) && (renewal_until == 0)) {
+               result = NT_STATUS_INVALID_LOGON_TYPE;
+               goto failed;
+       }
+
        client_princ = talloc_strdup(state->mem_ctx, global_myname());
        if (client_princ == NULL) {
                result = NT_STATUS_NO_MEMORY;