auth:creds: Add obtained arg to cli_credentials_set_kerberos_state()

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/auth/credentials/credentials.c b/auth/credentials/credentials.c
index d851951c9ed07c61a2d9c5754e3eaae923d216a2..3975fba693fe1c0340f9a3b0b06ebdf4a3d1965a 100644 (file)
--- a/auth/credentials/credentials.c
+++ b/auth/credentials/credentials.c
@@ -44,7 +44,7 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init(TALLOC_CTX *mem_ctx)
 
        cred->winbind_separator = '\\';
 
-       cred->use_kerberos = CRED_USE_KERBEROS_DESIRED;
+       cred->kerberos_state = CRED_USE_KERBEROS_DESIRED;
 
        cred->signing_state = SMB_SIGNING_DEFAULT;
 
@@ -108,10 +108,18 @@ _PUBLIC_ struct cli_credentials *cli_credentials_init_anon(TALLOC_CTX *mem_ctx)
        return anon_credentials;
 }
 
-_PUBLIC_ void cli_credentials_set_kerberos_state(struct cli_credentials *creds, 
-                                       enum credentials_use_kerberos use_kerberos)
+_PUBLIC_ bool cli_credentials_set_kerberos_state(struct cli_credentials *creds,
+                                                enum credentials_use_kerberos kerberos_state,
+                                                enum credentials_obtained obtained)
 {
-       creds->use_kerberos = use_kerberos;
+       if (obtained >= creds->kerberos_state_obtained) {
+               creds->kerberos_state = kerberos_state;
+               creds->kerberos_state_obtained = obtained;
+
+               return true;
+       }
+
+       return false;
 }
 
 _PUBLIC_ void cli_credentials_set_forced_sasl_mech(struct cli_credentials *creds,
@@ -129,7 +137,7 @@ _PUBLIC_ void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
 
 _PUBLIC_ enum credentials_use_kerberos cli_credentials_get_kerberos_state(struct cli_credentials *creds)
 {
-       return creds->use_kerberos;
+       return creds->kerberos_state;
 }
 
 _PUBLIC_ const char *cli_credentials_get_forced_sasl_mech(struct cli_credentials *creds)
@@ -982,6 +990,12 @@ _PUBLIC_ void cli_credentials_set_conf(struct cli_credentials *cred,
                cred->encryption_state = lpcfg_client_smb_encrypt(lp_ctx);
                cred->encryption_state_obtained = CRED_SMB_CONF;
        }
+
+       if (cred->kerberos_state_obtained <= CRED_SMB_CONF) {
+               /* Will be set to default for invalid smb.conf values */
+               cred->kerberos_state = lpcfg_client_use_kerberos(lp_ctx);
+               cred->kerberos_state_obtained = CRED_SMB_CONF;
+       }
 }
 
 /**
@@ -1105,7 +1119,9 @@ _PUBLIC_ void cli_credentials_set_anonymous(struct cli_credentials *cred)
        cli_credentials_set_principal(cred, NULL, CRED_SPECIFIED);
        cli_credentials_set_realm(cred, NULL, CRED_SPECIFIED);
        cli_credentials_set_workstation(cred, "", CRED_UNINITIALISED);
-       cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_DISABLED);
+       cli_credentials_set_kerberos_state(cred,
+                                          CRED_USE_KERBEROS_DISABLED,
+                                          CRED_SPECIFIED);
 }
 
 /**
@@ -1592,8 +1608,9 @@ _PUBLIC_ void cli_credentials_dump(struct cli_credentials *creds)
                creds->self_service);
        DBG_ERR("  Target service: %s\n",
                creds->target_service);
-       DBG_ERR("  Kerberos state: %s\n",
-               krb5_state_to_str(creds->use_kerberos));
+       DBG_ERR("  Kerberos state: %s - %s\n",
+               krb5_state_to_str(creds->kerberos_state),
+               obtained_to_str(creds->kerberos_state_obtained));
        DBG_ERR("  Kerberos forwardable ticket: %s\n",
                krb5_fwd_to_str(creds->krb_forwardable));
        DBG_ERR("  Signing state: %s - %s\n",

diff --git a/auth/credentials/credentials.h b/auth/credentials/credentials.h
index 1802e3835942be369f12a6239e29acb078a357fd..bcbe012ec12a0c1df3f39976d2a512f6bea2b5a2 100644 (file)
--- a/auth/credentials/credentials.h
+++ b/auth/credentials/credentials.h
@@ -132,8 +132,9 @@ int cli_credentials_get_client_gss_creds(struct cli_credentials *cred,
                                         const char **error_string);
 void cli_credentials_set_forced_sasl_mech(struct cli_credentials *creds,
                                          const char *sasl_mech);
-void cli_credentials_set_kerberos_state(struct cli_credentials *creds, 
-                                       enum credentials_use_kerberos use_kerberos);
+bool cli_credentials_set_kerberos_state(struct cli_credentials *creds,
+                                       enum credentials_use_kerberos kerberos_state,
+                                       enum credentials_obtained obtained);
 void cli_credentials_set_krb_forwardable(struct cli_credentials *creds,
                                         enum credentials_krb_forwardable krb_forwardable);
 bool cli_credentials_set_domain(struct cli_credentials *cred, 

diff --git a/auth/credentials/credentials_internal.h b/auth/credentials/credentials_internal.h
index 3b86b7424481c227e4a1a50a606bde69039b22ff..d39ead3b379d83ddbd9729601f2d711e4178bdac 100644 (file)
--- a/auth/credentials/credentials_internal.h
+++ b/auth/credentials/credentials_internal.h
@@ -40,6 +40,7 @@ struct cli_credentials {
        enum credentials_obtained signing_state_obtained;
        enum credentials_obtained ipc_signing_state_obtained;
        enum credentials_obtained encryption_state_obtained;
+       enum credentials_obtained kerberos_state_obtained;
 
        /* Threshold values (essentially a MAX() over a number of the
         * above) for the ccache and GSS credentials, to ensure we
@@ -101,7 +102,7 @@ struct cli_credentials {
        bool machine_account;
 
        /* Should we be trying to use kerberos? */
-       enum credentials_use_kerberos use_kerberos;
+       enum credentials_use_kerberos kerberos_state;
 
        /* Should we get a forwardable ticket? */
        enum credentials_krb_forwardable krb_forwardable;

diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index d7b1c43084174e7122f853ff49be8b57f31cf7f0..c03d80ac440ddad2cf385a52382c1d2ae286d31d 100644 (file)
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -1433,7 +1433,9 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *
        cred->impersonate_principal = talloc_strdup(cred, principal);
        talloc_free(cred->self_service);
        cred->self_service = talloc_strdup(cred, self_service);
-       cli_credentials_set_kerberos_state(cred, CRED_USE_KERBEROS_REQUIRED);
+       cli_credentials_set_kerberos_state(cred,
+                                          CRED_USE_KERBEROS_REQUIRED,
+                                          CRED_SPECIFIED);
 }
 
 /*

diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c
index 1bec60e5dceffdb165964cc6fb1984df8bdf743b..49505f643151f1b28527322d273c1d8676353922 100644 (file)
--- a/auth/credentials/credentials_ntlm.c
+++ b/auth/credentials/credentials_ntlm.c
@@ -53,7 +53,7 @@ _PUBLIC_ NTSTATUS cli_credentials_get_ntlm_response(struct cli_credentials *cred
        const struct samr_Password *nt_hash = NULL;
        int rc;
 
-       if (cred->use_kerberos == CRED_USE_KERBEROS_REQUIRED) {
+       if (cred->kerberos_state == CRED_USE_KERBEROS_REQUIRED) {
                TALLOC_FREE(frame);
                return NT_STATUS_INVALID_PARAMETER_MIX;
        }

diff --git a/auth/credentials/credentials_secrets.c b/auth/credentials/credentials_secrets.c
index 58067a5bece2146da2949e03e8be2a94f3f347bf..ab2c9ddeef9a9aba62ccb295e38b2f8c00a4c79f 100644 (file)
--- a/auth/credentials/credentials_secrets.c
+++ b/auth/credentials/credentials_secrets.c
@@ -391,7 +391,9 @@ _PUBLIC_ NTSTATUS cli_credentials_set_machine_account_db_ctx(struct cli_credenti
                                break;
                        }
                }
-               cli_credentials_set_kerberos_state(cred, use_kerberos);
+               cli_credentials_set_kerberos_state(cred,
+                                                  use_kerberos,
+                                                  CRED_SPECIFIED);
                cli_credentials_set_username(cred, machine_account, CRED_SPECIFIED);
                cli_credentials_set_password_last_changed_time(cred, secrets_tdb_lct);
                cli_credentials_set_secure_channel_type(cred, secrets_tdb_secure_channel_type);

diff --git a/auth/credentials/pycredentials.c b/auth/credentials/pycredentials.c
index 4c9ad0bde44a6251c0d8ea1326212aab90b18f7b..127085f4950cd9eae1eb9c275886c5c8036dc2b6 100644 (file)
--- a/auth/credentials/pycredentials.c
+++ b/auth/credentials/pycredentials.c
@@ -569,7 +569,7 @@ static PyObject *py_creds_set_kerberos_state(PyObject *self, PyObject *args)
        if (!PyArg_ParseTuple(args, "i", &state))
                return NULL;
 
-       cli_credentials_set_kerberos_state(creds, state);
+       cli_credentials_set_kerberos_state(creds, state, CRED_SPECIFIED);
        Py_RETURN_NONE;
 }
 

diff --git a/auth/credentials/tests/simple.c b/auth/credentials/tests/simple.c
index b39d7a2251b47709a4028fca198408d579f46d5f..32a9ca7c53316482c7974a6a323721ff58b7d16c 100644 (file)
--- a/auth/credentials/tests/simple.c
+++ b/auth/credentials/tests/simple.c
@@ -73,7 +73,9 @@ static bool test_guess(struct torture_context *tctx)
        const char *passwd_fd = getenv("PASSWD_FD");
        const char *passwd_file = getenv("PASSWD_FILE");
 
-       cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
+       cli_credentials_set_kerberos_state(creds,
+                                          CRED_USE_KERBEROS_REQUIRED,
+                                          CRED_SPECIFIED);
 
        unsetenv("USER");
        unsetenv("PASSWD_FD");
@@ -98,7 +100,9 @@ static bool test_guess(struct torture_context *tctx)
        if (passwd_file != NULL) {
                setenv("PASSWD_FILE", passwd_file, 1);
        }
-       cli_credentials_set_kerberos_state(creds, old_kerb_state);
+       cli_credentials_set_kerberos_state(creds,
+                                          old_kerb_state,
+                                          CRED_SPECIFIED);
 
        return true;
 }

diff --git a/examples/winexe/winexe.c b/examples/winexe/winexe.c
index 529858ccbb8e0d486bafcfb3a4e32898821a6500..bcf1212874b5abee67534a0f151a67bbb98077c7 100644 (file)
--- a/examples/winexe/winexe.c
+++ b/examples/winexe/winexe.c
@@ -284,7 +284,8 @@ static void parse_args(int argc, const char *argv[],
                cli_credentials_set_kerberos_state(cred,
                                                   strcmp(opt_kerberos, "yes")
                                                   ? CRED_USE_KERBEROS_REQUIRED
-                                                  : CRED_USE_KERBEROS_DISABLED);
+                                                  : CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        if (options->runas == NULL && options->runas_file != NULL) {

diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index e4ff2b7dedc3ab4523cabcc75e6297ec217d94b1..ebb1f19bd540e0105370560136453380a0587e26 100644 (file)
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -349,9 +349,13 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
                cli_credentials_set_conf(server_credentials, lp_ctx);
 
                if (lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
-                       cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED);
+                       cli_credentials_set_kerberos_state(server_credentials,
+                                                          CRED_USE_KERBEROS_DESIRED,
+                                                          CRED_SPECIFIED);
                } else {
-                       cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED);
+                       cli_credentials_set_kerberos_state(server_credentials,
+                                                          CRED_USE_KERBEROS_DISABLED,
+                                                          CRED_SPECIFIED);
                }
 
                nt_status = gensec_server_start(tmp_ctx, gensec_settings,

diff --git a/source3/lib/netapi/cm.c b/source3/lib/netapi/cm.c
index d6b7c868c2211e81a85501caeefa7c696b945602..c54f955d617dacf216f4e850a8aef556caaa87b9 100644 (file)
--- a/source3/lib/netapi/cm.c
+++ b/source3/lib/netapi/cm.c
@@ -105,7 +105,9 @@ static WERROR libnetapi_open_ipc_connection(struct libnetapi_ctx *ctx,
        if (username != NULL && username[0] != '\0' &&
            password != NULL && password[0] != '\0' &&
            krb5_state == CRED_USE_KERBEROS_REQUIRED) {
-               cli_credentials_set_kerberos_state(ctx->creds, CRED_USE_KERBEROS_DESIRED);
+               cli_credentials_set_kerberos_state(ctx->creds,
+                                                  CRED_USE_KERBEROS_DESIRED,
+                                                  CRED_SPECIFIED);
        }
 
        status = cli_cm_open(ctx, NULL,

diff --git a/source3/lib/netapi/netapi.c b/source3/lib/netapi/netapi.c
index a56651d100fc95ad077a1e590eb0b395e75675e4..56e26c83fa49ae8411da145a97deff6393775b12 100644 (file)
--- a/source3/lib/netapi/netapi.c
+++ b/source3/lib/netapi/netapi.c
@@ -342,7 +342,8 @@ NET_API_STATUS libnetapi_set_creds(struct libnetapi_ctx *ctx,
 NET_API_STATUS libnetapi_set_use_kerberos(struct libnetapi_ctx *ctx)
 {
        cli_credentials_set_kerberos_state(ctx->creds,
-                                          CRED_USE_KERBEROS_REQUIRED);
+                                          CRED_USE_KERBEROS_REQUIRED,
+                                          CRED_SPECIFIED);
 
        return NET_API_STATUS_SUCCESS;
 }

diff --git a/source3/lib/util_cmdline.c b/source3/lib/util_cmdline.c
index d2af34ee19b30a6b14a6764253ceadc67e30ca91..5374a29a514d5ff396cd9d772b71172f0b3f529b 100644 (file)
--- a/source3/lib/util_cmdline.c
+++ b/source3/lib/util_cmdline.c
@@ -312,7 +312,9 @@ void set_cmdline_auth_info_use_kerberos(struct user_auth_info *auth_info,
                krb5_state = CRED_USE_KERBEROS_DISABLED;
        }
 
-       cli_credentials_set_kerberos_state(auth_info->creds, krb5_state);
+       cli_credentials_set_kerberos_state(auth_info->creds,
+                                          krb5_state,
+                                          CRED_SPECIFIED);
 }
 
 bool get_cmdline_auth_info_use_kerberos(const struct user_auth_info *auth_info)
@@ -351,7 +353,9 @@ void set_cmdline_auth_info_fallback_after_kerberos(struct user_auth_info *auth_i
                break;
        }
 
-       cli_credentials_set_kerberos_state(auth_info->creds, krb5_state);
+       cli_credentials_set_kerberos_state(auth_info->creds,
+                                          krb5_state,
+                                          CRED_SPECIFIED);
 }
 
 bool get_cmdline_auth_info_fallback_after_kerberos(const struct user_auth_info *auth_info)

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index 90ffa040ec053fb8084f61f4dddc3a4716f20214..60fa2bf80cb758716477ab71dfbc5448978b0089 100644 (file)
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -163,7 +163,8 @@ static ADS_STATUS ads_sasl_spnego_gensec_bind(ADS_STRUCT *ads,
        }
 
        cli_credentials_set_kerberos_state(auth_generic_state->credentials,
-                                          krb5_state);
+                                          krb5_state,
+                                          CRED_SPECIFIED);
 
        if (target_service != NULL) {
                nt_status = gensec_set_target_service(

diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index bd3aeec94343ae627fdd98597db34c1c714282ce..fb28fa44dfe3a79e774b70e73ec241b5bf2a2548 100644 (file)
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -1707,7 +1707,8 @@ NTSTATUS libnet_join_ok(struct messaging_context *msg_ctx,
 
        if (use_kerberos) {
                cli_credentials_set_kerberos_state(cli_creds,
-                               CRED_USE_KERBEROS_REQUIRED);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        }
 
        status = cli_full_connection_creds(&cli, NULL,

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index b95b14b018cb5fad61a52a4ef84941b7bbd97212..b13e43f98013beaad9fca2c28cdfe48efb956180 100644 (file)
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -123,13 +123,16 @@ struct cli_credentials *cli_session_creds_init(TALLOC_CTX *mem_ctx,
 
        if (use_kerberos && fallback_after_kerberos) {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_DESIRED);
+                                                  CRED_USE_KERBEROS_DESIRED,
+                                                  CRED_SPECIFIED);
        } else if (use_kerberos) {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_REQUIRED);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        } else {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_DISABLED);
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        if (use_ccache) {

diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index f4cbbe6c06ebfd3fa738351537840ca6e6dc187c..73fcb3da30812b9642e17fffb5b8e6f542335e92 100644 (file)
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -2683,7 +2683,9 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
                /*
                 * It's not possible to use NTLMSSP with a domain trust account.
                 */
-               cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
+               cli_credentials_set_kerberos_state(creds,
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        } else {
                /*
                 * We can't use kerberos against an NT4 domain.
@@ -2691,7 +2693,9 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
                 * We should have a mode that also disallows NTLMSSP here,
                 * as only NETLOGON SCHANNEL is possible.
                 */
-               cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
+               cli_credentials_set_kerberos_state(creds,
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
@@ -2709,7 +2713,9 @@ NTSTATUS pdb_get_trust_credentials(const char *netbios_domain,
                /*
                 * We currently can't do kerberos just with an NTHASH.
                 */
-               cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
+               cli_credentials_set_kerberos_state(creds,
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
                goto done;
        }
 

diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c
index 9d1fcf8bd4221e80366053a5f5e13c44cb52706c..4f1d2f697f00dbc7063b755d019cbd2cf92ea11c 100644 (file)
--- a/source3/passdb/pdb_samba_dsdb.c
+++ b/source3/passdb/pdb_samba_dsdb.c
@@ -2518,13 +2518,15 @@ static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
                 * Force kerberos if this is an active directory domain
                 */
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_REQUIRED);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        } else  {
                /*
                 * TODO: we should allow krb5 with the raw nt hash.
                 */
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_DISABLED);
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        *_creds = talloc_move(mem_ctx, &creds);

diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index 4d6f584506219f7f1fe8e4fcd79bc6fa3a2abf8a..4ed74ae52b02a90c4c8937d9c13a60b6653b8189 100644 (file)
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -2569,7 +2569,9 @@ static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
                goto fail;
        }
 
-       cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
+       cli_credentials_set_kerberos_state(auth_generic_ctx->credentials,
+                                          use_kerberos,
+                                          CRED_SPECIFIED);
        cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
 
        status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);

diff --git a/source3/rpcclient/rpcclient.c b/source3/rpcclient/rpcclient.c
index 2939145d5949ff7edd1ab22de47fa93f28c0062e..8b59fb87c6725385242660e282680b9116037bd2 100644 (file)
--- a/source3/rpcclient/rpcclient.c
+++ b/source3/rpcclient/rpcclient.c
@@ -911,8 +911,9 @@ static NTSTATUS do_cmd(struct cli_state *cli,
                        case DCERPC_AUTH_TYPE_SPNEGO:
                        case DCERPC_AUTH_TYPE_NTLMSSP:
                        case DCERPC_AUTH_TYPE_KRB5:
-                               cli_credentials_set_kerberos_state(
-                                       creds, krb5_state);
+                               cli_credentials_set_kerberos_state(creds,
+                                                                  krb5_state,
+                                                                  CRED_SPECIFIED);
 
                                ntresult = cli_rpc_pipe_open_with_creds(
                                        cli, cmd_entry->table,

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 5300dfbef80ff851d3cf46149cdf284a3b3ca026..fbafa51cbb8da4824abed5e0f317070fefaba658 100644 (file)
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -2478,7 +2478,9 @@ static int net_ads_printer_publish(struct net_context *c, int argc, const char *
                talloc_destroy(mem_ctx);
                return -1;
        }
-       cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_REQUIRED);
+       cli_credentials_set_kerberos_state(creds,
+                                          CRED_USE_KERBEROS_REQUIRED,
+                                          CRED_SPECIFIED);
 
        nt_status = cli_full_connection_creds(&cli, lp_netbios_name(), servername,
                                        &server_ss, 0,

diff --git a/source3/utils/net_util.c b/source3/utils/net_util.c
index 7383d593f536684e7836c07bc22b9f7bd38e1787..5747bfa581a1ccb0fd1c9b62cc4df4d76f858a9f 100644 (file)
--- a/source3/utils/net_util.c
+++ b/source3/utils/net_util.c
@@ -499,13 +499,16 @@ struct cli_credentials *net_context_creds(struct net_context *c,
 
        if (c->opt_kerberos && c->opt_user_specified) {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_DESIRED);
+                                                  CRED_USE_KERBEROS_DESIRED,
+                                                  CRED_SPECIFIED);
        } else if (c->opt_kerberos) {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_REQUIRED);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
        } else {
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_DISABLED);
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        if (c->opt_ccache) {

diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
index 0370803167ff8c2bf73242b4cb5c3870358d6476..d833ee90b35138fa6f460796dbaced237815e660 100644 (file)
--- a/source3/utils/ntlm_auth.c
+++ b/source3/utils/ntlm_auth.c
@@ -1365,9 +1365,13 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx,
        cli_credentials_set_conf(server_credentials, lp_ctx);
 
        if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
-               cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DESIRED);
+               cli_credentials_set_kerberos_state(server_credentials,
+                                                  CRED_USE_KERBEROS_DESIRED,
+                                                  CRED_SPECIFIED);
        } else {
-               cli_credentials_set_kerberos_state(server_credentials, CRED_USE_KERBEROS_DISABLED);
+               cli_credentials_set_kerberos_state(server_credentials,
+                                                  CRED_USE_KERBEROS_DISABLED,
+                                                  CRED_SPECIFIED);
        }
 
        nt_status = gensec_server_start(tmp_ctx, gensec_settings,

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 431916a82a35e526cf51215460c92c9cb182893c..df785a0ba623bdfb2288449920da94d732b0e883 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -708,7 +708,9 @@ static NTSTATUS cm_get_ipc_credentials(TALLOC_CTX *mem_ctx,
        }
 
        cli_credentials_set_conf(creds, lp_ctx);
-       cli_credentials_set_kerberos_state(creds, CRED_USE_KERBEROS_DISABLED);
+       cli_credentials_set_kerberos_state(creds,
+                                          CRED_USE_KERBEROS_DISABLED,
+                                          CRED_SPECIFIED);
 
        ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
        if (!ok) {

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 165200044156ad553505b3d7bf34e9437c103fa5..9adc477a15cbf2de651ef154bc41102feb73ceeb 100644 (file)
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -1557,7 +1557,9 @@ static NTSTATUS gensec_gssapi_session_info(struct gensec_security *gensec_securi
                }
                
                /* This credential handle isn't useful for password authentication, so ensure nobody tries to do that */
-               cli_credentials_set_kerberos_state(session_info->credentials, CRED_USE_KERBEROS_REQUIRED);
+               cli_credentials_set_kerberos_state(session_info->credentials,
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
 
                /* It has been taken from this place... */
                gensec_gssapi_state->delegated_cred_handle = GSS_C_NO_CREDENTIAL;

diff --git a/source4/auth/session.c b/source4/auth/session.c
index 8e44dcd24f1c407f780f988f82b22a159e582b99..e6b6653bb1de52009689a2ddd7fe544beca1f99d 100644 (file)
--- a/source4/auth/session.c
+++ b/source4/auth/session.c
@@ -295,7 +295,8 @@ struct auth_session_info *auth_session_info_from_transport(TALLOC_CTX *mem_ctx,
                /* This credential handle isn't useful for password
                 * authentication, so ensure nobody tries to do that */
                cli_credentials_set_kerberos_state(creds,
-                                                  CRED_USE_KERBEROS_REQUIRED);
+                                                  CRED_USE_KERBEROS_REQUIRED,
+                                                  CRED_SPECIFIED);
 
        }
 #endif

diff --git a/source4/lib/cmdline/popt_credentials.c b/source4/lib/cmdline/popt_credentials.c
index 694b6ef8b95009b445b02ae43cef80a22d89317b..552e68b7eeb5c1a2d38386c17afab4637030fd4b 100644 (file)
--- a/source4/lib/cmdline/popt_credentials.c
+++ b/source4/lib/cmdline/popt_credentials.c
@@ -121,7 +121,8 @@ static void popt_common_credentials_callback(poptContext con,
                        popt_get_cmdline_credentials(),
                                                   use_kerberos 
                                                   ? CRED_USE_KERBEROS_REQUIRED
-                                                  : CRED_USE_KERBEROS_DISABLED);
+                                                  : CRED_USE_KERBEROS_DISABLED,
+                       CRED_SPECIFIED);
                break;
        }
                

diff --git a/source4/torture/ldap/session_expiry.c b/source4/torture/ldap/session_expiry.c
index e5e384507458dbd9014ea85eb56cf563bcc99c2a..ecb722fc4b816283c9daae82f6053caf09bc9246 100644 (file)
--- a/source4/torture/ldap/session_expiry.c
+++ b/source4/torture/ldap/session_expiry.c
@@ -54,8 +54,9 @@ bool torture_ldap_session_expiry(struct torture_context *torture)
        torture_assert_goto(
                torture, url!=NULL, ret, fail, "talloc_asprintf failed");
 
-       cli_credentials_set_kerberos_state(
-               credentials, CRED_USE_KERBEROS_REQUIRED);
+       cli_credentials_set_kerberos_state(credentials,
+                                          CRED_USE_KERBEROS_REQUIRED,
+                                          CRED_SPECIFIED);
 
        ok = lpcfg_set_option(
                torture->lp_ctx, "gensec_gssapi:requested_life_time=4");

diff --git a/source4/torture/rpc/schannel.c b/source4/torture/rpc/schannel.c
index a5755041040b74940b7ddc8e357220c06116e661..2c708dc806fc3e1eba4b5c6965979602553e452c 100644 (file)
--- a/source4/torture/rpc/schannel.c
+++ b/source4/torture/rpc/schannel.c
@@ -965,8 +965,12 @@ bool torture_rpc_schannel_bench1(struct torture_context *torture)
        torture_assert(torture, s->join_ctx2 != NULL,
                       "Failed to join domain with acct_flags=ACB_WSTRUST");
 
-       cli_credentials_set_kerberos_state(s->wks_creds1, CRED_USE_KERBEROS_DISABLED);
-       cli_credentials_set_kerberos_state(s->wks_creds2, CRED_USE_KERBEROS_DISABLED);
+       cli_credentials_set_kerberos_state(s->wks_creds1,
+                                          CRED_USE_KERBEROS_DISABLED,
+                                          CRED_SPECIFIED);
+       cli_credentials_set_kerberos_state(s->wks_creds2,
+                                          CRED_USE_KERBEROS_DISABLED,
+                                          CRED_SPECIFIED);
 
        for (i=0; i < s->nprocs; i++) {
                struct cli_credentials *wks = s->wks_creds1;