r21046: Backing out svn r20403 (Andrew's krb5 ticket cleanup

as this is causing the WRONG_PASSWORD error in the SetUserInfo()
call during net ads join).

We are now back to always list RC4-HMAC first if supported by
the krb5 libraries.
(This used to be commit 4fb57bce87588ac4898588ea4988eadff3a7f435)

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index d1699dbab7812ff589ed2226bc716fa284076c16..7d1fd0d1a839749ef2160d1762c33de5a8a8a4a9 100644 (file)
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -42,6 +42,7 @@ static ADS_STATUS ads_sasl_spnego_ntlmssp_bind(ADS_STRUCT *ads)
        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_client_start(&ntlmssp_state))) {
                return ADS_ERROR_NT(nt_status);
        }
+       ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
 
        if (!NT_STATUS_IS_OK(nt_status = ntlmssp_set_username(ntlmssp_state, ads->auth.user_name))) {
                return ADS_ERROR_NT(nt_status);
@@ -282,6 +283,12 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
        ADS_STATUS status;
        krb5_principal principal;
        krb5_context ctx = NULL;
+       krb5_enctype enc_types[] = {
+#ifdef ENCTYPE_ARCFOUR_HMAC
+                       ENCTYPE_ARCFOUR_HMAC,
+#endif
+                       ENCTYPE_DES_CBC_MD5,
+                       ENCTYPE_NULL};
        gss_OID_desc nt_principal = 
        {10, CONST_DISCARD(char *, "\052\206\110\206\367\022\001\002\002\002")};
 
@@ -294,6 +301,10 @@ static ADS_STATUS ads_sasl_gssapi_bind(ADS_STRUCT *ads)
        if (!ADS_ERR_OK(status)) {
                return status;
        }
+       status = ADS_ERROR_KRB5(krb5_set_default_tgs_ktypes(ctx, enc_types));
+       if (!ADS_ERR_OK(status)) {
+               return status;
+       }
        status = ADS_ERROR_KRB5(smb_krb5_parse_name(ctx, sname, &principal));
        if (!ADS_ERR_OK(status)) {
                return status;

diff --git a/source3/libsmb/clikrb5.c b/source3/libsmb/clikrb5.c
index 0df45f1b4d5d6835de05bdcca90713e88192cd9b..4092b4b2b90698daf81c4e5ddae57053e2be1146 100644 (file)
--- a/source3/libsmb/clikrb5.c
+++ b/source3/libsmb/clikrb5.c
@@ -130,6 +130,35 @@ static krb5_error_code smb_krb5_parse_name_norealm_conv(krb5_context context,
 }
 #endif
 
+#if !defined(HAVE_KRB5_SET_DEFAULT_TGS_KTYPES)
+
+#if defined(HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES)
+
+/* With MIT kerberos, we should use krb5_set_default_tgs_enctypes in preference
+ * to krb5_set_default_tgs_ktypes. See
+ *         http://lists.samba.org/archive/samba-technical/2006-July/048271.html
+ *
+ * If the MIT libraries are not exporting internal symbols, we will end up in
+ * this branch, which is correct. Otherwise we will continue to use the
+ * internal symbol
+ */
+ krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
+{
+    return krb5_set_default_tgs_enctypes(ctx, enc);
+}
+
+#elif defined(HAVE_KRB5_SET_DEFAULT_IN_TKT_ETYPES)
+
+/* Heimdal */
+ krb5_error_code krb5_set_default_tgs_ktypes(krb5_context ctx, const krb5_enctype *enc)
+{
+       return krb5_set_default_in_tkt_etypes(ctx, enc);
+}
+
+#endif /* HAVE_KRB5_SET_DEFAULT_TGS_ENCTYPES */
+
+#endif /* HAVE_KRB5_SET_DEFAULT_TGS_KTYPES */
+
 #if defined(HAVE_ADDR_TYPE_IN_KRB5_ADDRESS)
 /* HEIMDAL */
  void setup_kaddr( krb5_address *pkaddr, struct sockaddr *paddr)
@@ -612,6 +641,13 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
        krb5_context context = NULL;
        krb5_ccache ccdef = NULL;
        krb5_auth_context auth_context = NULL;
+       krb5_enctype enc_types[] = {
+#ifdef ENCTYPE_ARCFOUR_HMAC
+               ENCTYPE_ARCFOUR_HMAC,
+#endif 
+               ENCTYPE_DES_CBC_MD5, 
+               ENCTYPE_DES_CBC_CRC, 
+               ENCTYPE_NULL};
 
        initialize_krb5_error_table();
        retval = krb5_init_context(&context);
@@ -632,6 +668,12 @@ int cli_krb5_get_ticket(const char *principal, time_t time_offset,
                goto failed;
        }
 
+       if ((retval = krb5_set_default_tgs_ktypes(context, enc_types))) {
+               DEBUG(1,("cli_krb5_get_ticket: krb5_set_default_tgs_ktypes failed (%s)\n",
+                        error_message(retval)));
+               goto failed;
+       }
+
        if ((retval = ads_krb5_mk_req(context, 
                                        &auth_context, 
                                        AP_OPTS_USE_SUBKEY | (krb5_flags)extra_ap_opts,