sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-06 13:18:07 +03:00
Code

s4:auth_sam: use USER_INFO_INTERACTIVE_LOGON as inducation for an interactive logon

Browse Source 
Using != AUTH_PASSWORD_RESPONSE is not the correct indication
due to the local mappings from AUTH_PASSWORD_PLAIN via
AUTH_PASSWORD_HASH to AUTH_PASSWORD_RESPONSE.

It means an LDAP simble bind will now honour
'old password allowed period'.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13879
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15001

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
(cherry picked from commit 2ad4468622)
This commit is contained in:
Stefan Metzmacher 2022-03-04 19:09:41 +01:00 committed by Jule Anger
parent f0891c0a89
commit 1a0d92a9be
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/samba4.ldap.login_basics
View File

@ -1 +0,0 @@
^samba4.ldap.login_basics.python.*.__main__.BasicUserAuthTests.test_login_basics_simple

5
source4/auth/ntlm/auth_sam.c
View File

@ -410,10 +410,11 @@ static NTSTATUS authsam_password_check_and_record(struct auth4_context *auth_con
return NT_STATUS_WRONG_PASSWORD;
}
if (user_info->password_state != AUTH_PASSWORD_RESPONSE) {
if (user_info->flags & USER_INFO_INTERACTIVE_LOGON) {
/*
* The authentication was OK against the previous password,
* but it's not a NTLM network authentication.
* but it's not a NTLM network authentication,
* LDAP simple bind or something similar.
*
* We just return the original wrong password.
* This skips the update of the bad pwd count,