windows-do-not-discard-badtickets-20080218

LICENSE MIT

The RXKADBADTICKET error is returned when a krb5 derived token is sent
to a server that does not support them.  In a mixed cell it is possible
that some servers were not updated.  Discarding the token does not make
it possible to perform the request successfully and adversely affects
the user experience because those servers that do support the token
can no longer be accessed in an authenticated manner.  Users can't
determine what the cause is, all they see are their tokens disappearing
and there is nothing they can do about it anyway.

From now on return STATUS_NO_KERB_KEY and do not retry.

diff --git a/src/WINNT/afsd/cm_conn.c b/src/WINNT/afsd/cm_conn.c
index 5aa65c4a35571be4d88f74918ed5622079f6f152..87e3db4f20fe68e6398ae7728d3c30eb8c410c60 100644 (file)
--- a/src/WINNT/afsd/cm_conn.c
+++ b/src/WINNT/afsd/cm_conn.c
@@ -571,7 +571,7 @@ cm_Analyze(cm_conn_t *connp, cm_user_t *userp, cm_req_t *reqp,
         if ( timeLeft > 2 )
             retry = 1;
     }
-    else if (errorCode == RXKADEXPIRED || errorCode == RXKADBADTICKET) {
+    else if (errorCode == RXKADEXPIRED) {
         if (!dead_session) {
             lock_ObtainMutex(&userp->mx);
             ucellp = cm_GetUCell(userp, serverp->cellp);

diff --git a/src/WINNT/afsd/smb.c b/src/WINNT/afsd/smb.c
index ef61883318d8241ce4beb44ea335c06b759c32a0..c4a25341703e51267f2635047788fc7a31b8304b 100644 (file)
--- a/src/WINNT/afsd/smb.c
+++ b/src/WINNT/afsd/smb.c
@@ -2636,8 +2636,8 @@ void smb_MapNTError(long code, unsigned long *NTStatusp)
     else if (code == CM_ERROR_ALLOFFLINE || code == CM_ERROR_ALLDOWN) {
         NTStatus = 0xC00000BEL; /* Bad Network Path */
     } 
-    else if (code == RXKADUNKNOWNKEY) {
-       NTStatus = 0xC0000322L; /* Bad Kerberos key */
+    else if (code >= ERROR_TABLE_BASE_RXK && code < ERROR_TABLE_BASE_RXK + 256) {
+       NTStatus = 0xC0000322L; /* No Kerberos key */
     } 
     else if (code == CM_ERROR_BAD_LEVEL) {
        NTStatus = 0xC0000148L; /* Invalid Level */