diff options
| author | Volker Lendecke <vl@samba.org> | 2017-02-11 15:05:52 +0100 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2017-03-24 11:57:08 +0100 |
| commit | c98614152cad7a463d4008064f140134cc5b8441 (patch) | |
| tree | 1b8bf89d7d38e49b258caeee40b17ffaaddef3ff /source3/auth/auth.c | |
| parent | 1e82d82571d33e0ff50c3f5fc461bf9dddc18fa5 (diff) | |
| download | samba-c98614152cad7a463d4008064f140134cc5b8441.tar.gz | |
auth3: Don't try other auth modules on any error
So far if any kind of error has happened, we just tried further auth
modules. An auth module should have the chance to definitely say "no,
this is a valid error, no further attempts anywhere else". The protocol
so far was for an auth module to return NT_STATUS_NOT_IMPLEMENTED if it
wanted to pass on to other modules, but any error led to the next auth
modules also being given a try.
This patch makes any auth module return code except NOT_IMPLEMENTED to
terminate the loop, such that every module has to explicitly request to
pass on to the next module via NOT_IMPLEMENTED.
All modules we reference in make_auth_context_subsystem() have code to
explicitly say "not for me please" with NOT_IMPLEMENTED.
This *might* break existing setups which fail in for example "guest" or
"winbind" due to other reasons. I prefer it this way though, because
adding another parameter like "This is a real authoritative failure,
don't go looking somewhere else" will only add to the mess.
But it's more a theoretical than a practical change with the
default auth backends.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source3/auth/auth.c')
| -rw-r--r-- | source3/auth/auth.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/source3/auth/auth.c b/source3/auth/auth.c index 2b0eb50fcdc..ff41404f770 100644 --- a/source3/auth/auth.c +++ b/source3/auth/auth.c @@ -250,9 +250,7 @@ NTSTATUS auth_check_ntlm_password(TALLOC_CTX *mem_ctx, auth_method->name, user_info->client.account_name, nt_errstr(nt_status))); } - if (NT_STATUS_IS_OK(nt_status)) { - break; - } + break; } /* successful authentication */ |