From 17ea2ccdabbe935ef571e1227908d51b755707bc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Mon, 3 Jan 2022 11:13:06 +0100 Subject: s3:libads: Disable NTLMSSP if not allowed (for builds without kerberos) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BUG: https://bugzilla.samba.org/show_bug.cgi?id=14955 Pair-Programmed-With: Andreas Schneider Signed-off-by: Pavel Filipenský Signed-off-by: Andreas Schneider Reviewed-by: Stefan Metzmacher --- source3/libads/sasl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/source3/libads/sasl.c b/source3/libads/sasl.c index ea98aa47ecd..1bcfe0490a8 100644 --- a/source3/libads/sasl.c +++ b/source3/libads/sasl.c @@ -617,6 +617,12 @@ static ADS_STATUS ads_sasl_spnego_bind(ADS_STRUCT *ads) library for HMAC_MD4 encryption */ mech = "NTLMSSP"; + if (!(ads->auth.flags & ADS_AUTH_ALLOW_NTLMSSP)) { + DBG_WARNING("We can't use NTLMSSP, it is not allowed.\n"); + status = ADS_ERROR_NT(NT_STATUS_NETWORK_CREDENTIAL_CONFLICT); + goto done; + } + if (lp_weak_crypto() == SAMBA_WEAK_CRYPTO_DISALLOWED) { DBG_WARNING("We can't fallback to NTLMSSP, weak crypto is" " disallowed.\n"); -- cgit v1.2.1