s3:winbindd: don't use ads_kdestroy(NULL) in winbindd_raw_kerberos_login()
authorStefan Metzmacher <metze@samba.org>
Tue, 14 May 2024 07:02:07 +0000 (09:02 +0200)
committerStefan Metzmacher <metze@samba.org>
Tue, 14 May 2024 10:18:31 +0000 (10:18 +0000)
commit4959f932279105e1de7c0bdf11ea503e1967a341
tree63780198e7c521e8445512b25b49fc88fa6e7e42
parent712ffbffc03c7dcd551c1e22815ebe7c0b9b45d2
s3:winbindd: don't use ads_kdestroy(NULL) in winbindd_raw_kerberos_login()

This fixes a problem introduced in the commit:

commit e6c693b705686a590d2fa8f434ff015d8926a349
Author: Stefan Metzmacher <metze@samba.org>
Date:   Wed Feb 28 17:28:43 2024 +0100

    s3:winbindd: pass a NULL ccache to kerberos_return_pac() for a MEMORY ccache

    It means kerberos_return_pac() will use smb_krb5_cc_new_unique_memory().

    ...

Before that commit cc was never NULL as generate_krb5_ccache()
returned "MEMORY:winbindd_pam_ccache" as fallback.

So we called ads_kdestroy("MEMORY:winbindd_pam_ccache").

Now we have cc == NULL if user_ccache_file == NULL.

and kerberos_return_pac() uses smb_krb5_cc_new_unique_memory()
and krb5_cc_destroy() internally.

It means unless user_ccache_file != NULL we should not
call ads_kdestroy(cc) as cc is NULL and means we would destroy
any global default krb5 ccache.

Review with: git show -U25

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
source3/winbindd/winbindd_pam.c