Fix bug #5675 with a varient of Tim Waugh's patch,

as proposed by James Peach.
Jeremy.
(This used to be commit 5c27ad75836136c39774c9456d63f46fa62e281f)

diff --git a/source3/client/smbspool.c b/source3/client/smbspool.c
index e567ef8037aa8590048fa60696e69accf2869852..f35a9d3003e33c740bf5f310c3974dcc53d6f18f 100644 (file)
--- a/source3/client/smbspool.c
+++ b/source3/client/smbspool.c
@@ -347,7 +347,7 @@ get_exit_code(struct cli_state * cli,
                }
 
                if (cli) {
-                       if (cli->use_kerberos || (cli->capabilities & CAP_EXTENDED_SECURITY))
+                       if (cli->use_kerberos && cli->got_kerberos_mechanism)
                                fputs("ATTR: auth-info-required=negotiate\n", stderr);
                        else
                                fputs("ATTR: auth-info-required=username,password\n", stderr);

diff --git a/source3/include/client.h b/source3/include/client.h
index 9276948dac529a524613f830b26803600f36e14c..51ced9907f3006bf497d781fec1602b80ac3ab22 100644 (file)
--- a/source3/include/client.h
+++ b/source3/include/client.h
@@ -193,6 +193,7 @@ struct cli_state {
        bool use_kerberos;
        bool fallback_after_kerberos;
        bool use_spnego;
+       bool got_kerberos_mechanism; /* Server supports krb5 in SPNEGO. */
 
        bool use_oplocks; /* should we use oplocks? */
        bool use_level_II_oplocks; /* should we use level II oplocks? */

diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c
index 4285753e20595813308f3e22740bddaae666ce7b..8ef14d7973540b76ce9d23873bac193f236f8c4a 100644 (file)
--- a/source3/libsmb/cliconnect.c
+++ b/source3/libsmb/cliconnect.c
@@ -797,7 +797,6 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
        char *principal = NULL;
        char *OIDs[ASN1_MAX_OIDS];
        int i;
-       bool got_kerberos_mechanism = False;
        DATA_BLOB blob;
        const char *p = NULL;
        char *account = NULL;
@@ -832,7 +831,7 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
                DEBUG(3,("got OID=%s\n", OIDs[i]));
                if (strcmp(OIDs[i], OID_KERBEROS5_OLD) == 0 ||
                    strcmp(OIDs[i], OID_KERBEROS5) == 0) {
-                       got_kerberos_mechanism = True;
+                       cli->got_kerberos_mechanism = True;
                }
                free(OIDs[i]);
        }
@@ -845,7 +844,7 @@ ADS_STATUS cli_session_setup_spnego(struct cli_state *cli, const char *user,
        /* If password is set we reauthenticate to kerberos server
         * and do not store results */
 
-       if (got_kerberos_mechanism && cli->use_kerberos) {
+       if (cli->got_kerberos_mechanism && cli->use_kerberos) {
                ADS_STATUS rc;
 
                if (pass && *pass) {