openldap: handle Curl_sasl_continue() returns better

Similar to how it gets treated already in other protocol handlers.

Follow-up to eeca818b1e8d1e61c2d4

Reported-by: Eunsoo Kim
Closes #22213

diff --git a/lib/openldap.c b/lib/openldap.c
index ee765d8d05b2d3851014a11bce2c9799a1d4209c..6c15734d29acdb59be52a4dea2eec88014f4de99 100644 (file)
--- a/lib/openldap.c
+++ b/lib/openldap.c
@@ -791,8 +791,19 @@ static CURLcode oldap_state_sasl_resp(struct Curl_easy *data,
   }
   else {
     result = Curl_sasl_continue(&li->sasl, data, code, &progress);
-    if(!result && progress != SASL_INPROGRESS)
-      oldap_state(data, li, OLDAP_STOP);
+    if(!result) {
+      switch(progress) {
+      case SASL_DONE:
+        oldap_state(data, li, OLDAP_STOP);   /* Authenticated */
+        break;
+      case SASL_IDLE:            /* No mechanism left after cancellation */
+        failf(data, "Authentication cancelled");
+        result = CURLE_LOGIN_DENIED;
+        break;
+      default:
+        break;
+      }
+    }
   }
 
   if(li->servercred)