Skip to content

third_party/heimdal: Produce more helpful error messages for KERB-ERROR-DATA

Jo Sutton requested to merge samba-team/devel/samba:jsutton24/heimdal-kerb-error-data-2 into master

If the KDC returned KERB-ERROR-DATA in response to an FX-FAST request, the client would report the following message to the user: “FAST fast response is missing FX-FAST”. Not very helpful.

Now the error message should look more like “KDC policy rejects request (NT status code 0xc0000413)”.

We could improve things a bit more by emitting the actual error message rather than just an error code, or by extracting the status code out of the Heimdal context for gensec_gssapi_update_internal() to return. But this is acceptable for now.

Improves on !3377 (closed).

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15514

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • (optional) This MR is just one part towards a larger feature.
  • (optional, if backport required) Bugzilla bug filed and BUG: tag added
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated
  • CI timeout is 3h or higher (see Settings/CICD/General pipelines/ Timeout)

Reviewer's checklist:

  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to README.Coding.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code

Merge request reports