From: Pavel Filipenský <pfilipen@redhat.com>
Date: Mon, 3 Jan 2022 10:13:06 +0000 (+0100)
Subject: s3:libads: Disable NTLMSSP if not allowed (for builds without kerberos)
X-Git-Tag: tdb-1.4.6~7
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=17ea2ccdabbe935ef571e1227908d51b755707bc;p=thirdparty%2Fsamba.git

s3:libads: Disable NTLMSSP if not allowed (for builds without kerberos)

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

Signed-off-by: Pavel Filipenský <pfilipen@redhat.com>
Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c
index ea98aa47ecd..1bcfe0490a8 100644
--- a/source3/libads/sasl.c
+++ b/source3/libads/sasl.c
@@ -617,6 +617,12 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads)
 	   library for HMAC_MD4 encryption */
 	mech = "NTLMSSP";
 
+	if (!(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) {
+		DBG_WARNING("We can't use NTLMSSP, it is not allowed.\n");
+		status = ADS_ERROR_NT(NT_STATUS_NETWORK_CREDENTIAL_CONFLICT);
+		goto done;
+	}
+
 	if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) {
 		DBG_WARNING("We can't fallback to NTLMSSP, weak crypto is"
 			    " disallowed.\n");