s3-winbind: Do not delete an existing valid credential cache.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=9994

Thanks to David Woodhouse <dwmw2@infradead.org>.

Reviewed-by: Günther Deschner <gd@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Mon Jul 15 12:48:46 CEST 2013 on sn-devel-104

(cherry picked from commit 0529b59fbe3f96509893fc4e93a75d6928b5a532)

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index a9662028884e2e4b2bf37c2d443babbac07725b5..125e393220dc47007fccf97de35c920d4c074d86 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -668,6 +668,14 @@ static NTSTATUS winbindd_raw_kerberos_login(TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 
 failed:
+       /*
+        * Do not delete an existing valid credential cache, if the user
+        * e.g. enters a wrong password
+        */
+       if ((strequal(krb5_cc_type, "FILE") || strequal(krb5_cc_type, "WRFILE"))
+           && user_ccache_file != NULL) {
+               return result;
+       }
 
        /* we could have created a new credential cache with a valid tgt in it
         * but we werent able to get or verify the service ticket for this