- } else {
- DBG_ERR("gss_init_sec_context failed with [%s]\n",
- gse_errstr(talloc_tos(), gss_maj, gss_min));
+ /* Make SPNEGO ignore us, we can't go any further here */
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto done;
+ case (OM_uint32)KRB5KRB_AP_ERR_TKT_NYV:
+ DBG_NOTICE("Clockskew\n");
+ /* Make SPNEGO ignore us, we can't go any further here */
+ status = NT_STATUS_TIME_DIFFERENCE_AT_DC;
+ goto done;
+ case (OM_uint32)KRB5_KDC_UNREACH:
+ DBG_NOTICE("KDC unreachable\n");
+ /* Make SPNEGO ignore us, we can't go any further here */
+ status = NT_STATUS_NO_LOGON_SERVERS;
+ goto done;
+ case (OM_uint32)KRB5KRB_AP_ERR_MSG_TYPE:
+ /* Garbage input, possibly from the auto-mech detection */
+ status = NT_STATUS_INVALID_PARAMETER;
+ goto done;
+ default:
+ DBG_ERR("gss_init_sec_context failed with [%s](%u)\n",
+ gse_errstr(talloc_tos(), gss_maj, gss_min),
+ gss_min);
+ status = NT_STATUS_LOGON_FAILURE;
+ goto done;