3877N/A/* Licensed to the Apache Software Foundation (ASF) under one or more
3877N/A * contributor license agreements. See the NOTICE file distributed with
3877N/A * this work for additional information regarding copyright ownership.
3877N/A * The ASF licenses this file to You under the Apache License, Version 2.0
3877N/A * (the "License"); you may not use this file except in compliance with
3877N/A * the License. You may obtain a copy of the License at
3877N/A *
3877N/A * http://www.apache.org/licenses/LICENSE-2.0
3877N/A *
3877N/A * Unless required by applicable law or agreed to in writing, software
3877N/A * distributed under the License is distributed on an "AS IS" BASIS,
3877N/A * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
3877N/A * See the License for the specific language governing permissions and
3877N/A * limitations under the License.
3877N/A */
3877N/A
3877N/A/*
3877N/A * mod_auth_gss module
3877N/A *
3877N/A * Wyllys Ingersoll <wyllys.ingersoll@sun.com>
3877N/A *
3877N/A * Based on work by
3877N/A * Daniel Kouril <kouril@users.sourceforge.net>
3877N/A * James E. Robinson, III <james@ncstate.net>
3877N/A * Daniel Henninger <daniel@ncsu.edu>
3877N/A * Ludek Sulak <xsulak@fi.muni.cz>
3877N/A */
3877N/A
3877N/A/*
3877N/A * Copyright (c) 2007, 2015, Oracle and/or its affiliates. All rights reserved.
3877N/A */
3877N/A
3877N/A
3877N/A#include <sys/types.h>
3877N/A#include <strings.h>
3877N/A
3877N/A#include "httpd.h"
3877N/A#include "http_config.h"
3877N/A#include "http_core.h"
3877N/A#include "http_log.h"
3877N/A#include "http_protocol.h"
3877N/A#include "http_request.h"
3877N/A#include "ap_config.h"
3877N/A#include "apr_base64.h"
3877N/A#include "apr_lib.h"
3877N/A#include "apr_time.h"
3877N/A#include "apr_errno.h"
3877N/A#include "apr_global_mutex.h"
3877N/A#include "apr_strings.h"
3877N/A#include "ap_compat.h"
3877N/A
3877N/A#include <gssapi/gssapi.h>
3877N/A#include <gssapi/gssapi_ext.h>
3877N/A
3877N/Amodule auth_gss_module;
3877N/A
3877N/Astatic void *gss_create_dir_config(apr_pool_t *, char *);
3877N/A
3877N/Aint gss_authenticate(request_rec *);
3877N/A
3877N/Atypedef struct {
3877N/A char *gss_service_name;
3877N/A char *keytab_file;
3877N/A int gss_debug;
3877N/A} gss_auth_config;
3877N/A
3877N/Astatic const char *set_service_name(cmd_parms *cmd, void *config,
3877N/A const char *name)
3877N/A{
3877N/A ((gss_auth_config *) config)->gss_service_name = (char *)name;
3877N/A return NULL;
3877N/A}
3877N/A
3877N/Astatic const char *set_keytab_file(cmd_parms *cmd, void *config,
3877N/A const char *file)
3877N/A{
3877N/A ((gss_auth_config *) config)->keytab_file = (char *)file;
3877N/A return NULL;
3877N/A}
3877N/A
3877N/Astatic const char *set_gss_debug(cmd_parms *cmd, void *config,
3877N/A const char *debugflag)
3877N/A{
3877N/A ((gss_auth_config *) config)->gss_debug = atoi(debugflag);
3877N/A return NULL;
3877N/A}
3877N/A
3877N/Astatic const command_rec gss_auth_cmds[] = {
3877N/A AP_INIT_TAKE1("AuthGSSServiceName", set_service_name, NULL,
3877N/A OR_AUTHCFG, "Service name used for authentication."),
3877N/A
3877N/A AP_INIT_TAKE1("AuthGSSKeytabFile", set_keytab_file, NULL,
3877N/A OR_AUTHCFG,
3877N/A "Location of Kerberos V5 keytab file."),
3877N/A
3877N/A AP_INIT_TAKE1("AuthGssDebug", set_gss_debug, NULL,
3877N/A OR_AUTHCFG,
3877N/A "Enable debug logging in error_log"),
3877N/A { NULL }
3877N/A};
3877N/A
3877N/Astatic void
3877N/Agss_register_hooks(apr_pool_t *p)
3877N/A{
3877N/A ap_hook_check_user_id(gss_authenticate,NULL,NULL,APR_HOOK_MIDDLE);
3877N/A}
3877N/A
3877N/Amodule AP_MODULE_DECLARE_DATA auth_gss_module = {
3877N/A STANDARD20_MODULE_STUFF,
3877N/A gss_create_dir_config, /* dir config creater */
3877N/A NULL, /* dir merger --- default is to override */
3877N/A NULL, /* server config */
3877N/A NULL, /* merge server config */
3877N/A gss_auth_cmds, /* command apr_table_t */
3877N/A gss_register_hooks /* register hooks */
3877N/A};
3877N/A
3877N/Atypedef struct {
3877N/A gss_ctx_id_t context;
3877N/A gss_cred_id_t server_creds;
3877N/A} gss_connection_t;
3877N/A
3877N/Astatic gss_connection_t *gss_connection = NULL;
3877N/A
3877N/Astatic void *
3877N/Agss_create_dir_config(apr_pool_t *p, char *d)
3877N/A{
3877N/A gss_auth_config *rec =
3877N/A (gss_auth_config *) apr_pcalloc(p, sizeof(gss_auth_config));
3877N/A
3877N/A ((gss_auth_config *)rec)->gss_service_name = "HTTP";
3877N/A ((gss_auth_config *)rec)->keytab_file = "/var/apache2/http.keytab";
3877N/A ((gss_auth_config *)rec)->gss_debug = 0;
3877N/A
3877N/A return rec;
3877N/A}
3877N/A
3877N/Avoid log_rerror(const char *file, int line, int level, int status,
3877N/A const request_rec *r, const char *fmt, ...)
3877N/A{
3877N/A char errstr[1024];
3877N/A va_list ap;
3877N/A
3877N/A va_start(ap, fmt);
3877N/A vsnprintf(errstr, sizeof(errstr), fmt, ap);
3877N/A va_end(ap);
3877N/A
3877N/A ap_log_rerror(file, line, level | APLOG_NOERRNO, NULL, r, "%s", errstr);
3877N/A}
3877N/A
3877N/A/*********************************************************************
3877N/A * GSSAPI Authentication
3877N/A ********************************************************************/
3877N/Astatic const char *
3877N/Agss_error_msg(apr_pool_t *p, OM_uint32 maj, OM_uint32 min, char *prefix)
3877N/A{
3877N/A OM_uint32 maj_stat, min_stat;
3877N/A OM_uint32 msg_ctx = 0;
3877N/A gss_buffer_desc msg;
3877N/A
3877N/A char *err_msg = (char *)apr_pstrdup(p, prefix);
3877N/A
3877N/A do {
3877N/A maj_stat = gss_display_status (&min_stat,
3877N/A maj, GSS_C_GSS_CODE,
3877N/A GSS_C_NO_OID, &msg_ctx,
3877N/A &msg);
3877N/A if (GSS_ERROR(maj_stat))
3877N/A break;
3877N/A
3877N/A err_msg = apr_pstrcat(p, err_msg, ": ", (char*) msg.value,
3877N/A NULL);
3877N/A (void) gss_release_buffer(&min_stat, &msg);
3877N/A
3877N/A maj_stat = gss_display_status (&min_stat,
3877N/A min, GSS_C_MECH_CODE,
3877N/A GSS_C_NULL_OID, &msg_ctx,
3877N/A &msg);
3877N/A if (!GSS_ERROR(maj_stat)) {
3877N/A err_msg = apr_pstrcat(p, err_msg,
3877N/A " (", (char*) msg.value, ")", NULL);
3877N/A (void) gss_release_buffer(&min_stat, &msg);
3877N/A }
3877N/A } while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
3877N/A
3877N/A return (err_msg);
3877N/A}
3877N/A
3877N/Astatic int
3877N/Acleanup_gss_connection(void *data)
3877N/A{
3877N/A OM_uint32 ret;
3877N/A OM_uint32 minor_status;
3877N/A gss_connection_t *gss_conn = (gss_connection_t *)data;
3877N/A
3877N/A if (data == NULL)
3877N/A return 0;
3877N/A
3877N/A if (gss_conn->context != GSS_C_NO_CONTEXT) {
3877N/A (void) gss_delete_sec_context(&minor_status,
3877N/A &gss_conn->context,
3877N/A GSS_C_NO_BUFFER);
3877N/A }
3877N/A
3877N/A if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL) {
3877N/A (void) gss_release_cred(&minor_status, &gss_conn->server_creds);
3877N/A }
3877N/A
3877N/A gss_connection = NULL;
3877N/A
3877N/A return 0;
3877N/A}
3877N/A
3877N/Astatic int
3877N/Aacquire_server_creds(request_rec *r,
3877N/A gss_auth_config *conf,
3877N/A gss_OID_set mechset,
3877N/A gss_cred_id_t *server_creds)
3877N/A{
3877N/A int ret = 0;
3877N/A gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
3877N/A OM_uint32 major_status, minor_status, minor_status2;
3877N/A gss_name_t server_name = GSS_C_NO_NAME;
3877N/A char buf[1024];
3877N/A
3877N/A snprintf(buf, sizeof(buf), "%s@%s",
3877N/A conf->gss_service_name, r->hostname);
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "acquire_server_creds for %s", buf);
3877N/A
3877N/A input_token.value = buf;
3877N/A input_token.length = strlen(buf) + 1;
3877N/A
3877N/A major_status = gss_import_name(&minor_status, &input_token,
3877N/A GSS_C_NT_HOSTBASED_SERVICE,
3877N/A &server_name);
3877N/A
3877N/A if (GSS_ERROR(major_status)) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "%s", gss_error_msg(r->pool, major_status, minor_status,
3877N/A "gss_import_name() failed"));
3877N/A return (HTTP_INTERNAL_SERVER_ERROR);
3877N/A }
3877N/A
3877N/A major_status = gss_acquire_cred(&minor_status, server_name,
3877N/A GSS_C_INDEFINITE,
3877N/A mechset, GSS_C_ACCEPT,
3877N/A server_creds, NULL, NULL);
3877N/A
3877N/A if (GSS_ERROR(major_status)) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "%s", gss_error_msg(r->pool, major_status, minor_status,
3877N/A "gss_acquire_cred() failed"));
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A }
3877N/A (void) gss_release_name(&minor_status2, &server_name);
3877N/A
3877N/A return (ret);
3877N/A}
3877N/A
3877N/Astatic int
3877N/Aauthenticate_user_gss(request_rec *r, gss_auth_config *conf,
3877N/A const char *auth_line, char **negotiate_ret_value)
3877N/A{
3877N/A int ret = 0;
3877N/A OM_uint32 major_status, minor_status, minor_status2;
3877N/A gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
3877N/A gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
3877N/A const char *auth_param = NULL;
3877N/A gss_name_t client_name = GSS_C_NO_NAME;
3877N/A gss_cred_id_t delegated_cred = GSS_C_NO_CREDENTIAL;
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "authenticate_user_gss called");
3877N/A
3877N/A *negotiate_ret_value = (char *)"";
3877N/A
3877N/A if (gss_connection == NULL) {
3877N/A gss_connection = apr_pcalloc(r->connection->pool, sizeof(*gss_connection));
3877N/A if (gss_connection == NULL) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "apr_pcalloc() failed (not enough memory)");
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A goto end;
3877N/A }
3877N/A (void) memset(gss_connection, 0, sizeof(*gss_connection));
3877N/A apr_pool_cleanup_register(r->connection->pool, gss_connection,
3877N/A cleanup_gss_connection, apr_pool_cleanup_null);
3877N/A }
3877N/A
3877N/A if (conf->keytab_file) {
3877N/A char *ktname;
3877N/A /*
3877N/A * We don't use the ap_* calls here, since the string
3877N/A * passed to putenv() will become part of the enviroment
3877N/A * and shouldn't be free()ed by apache.
3877N/A */
3877N/A ktname = malloc(strlen("KRB5_KTNAME=") + strlen(conf->keytab_file) + 1);
3877N/A if (ktname == NULL) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "malloc() failed: not enough memory");
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A goto end;
3877N/A }
3877N/A /*
3877N/A * Put the keytab name in the environment so that Kerberos
3877N/A * knows where to look later.
3877N/A */
3877N/A sprintf(ktname, "KRB5_KTNAME=%s", conf->keytab_file);
3877N/A putenv(ktname);
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "Using keytab: %s", ktname);
3877N/A }
3877N/A
3877N/A /* ap_getword() shifts parameter */
3877N/A auth_param = ap_getword_white(r->pool, &auth_line);
3877N/A if (auth_param == NULL) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "No Authorization parameter in request from client");
3877N/A ret = HTTP_UNAUTHORIZED;
3877N/A goto end;
3877N/A }
3877N/A
3877N/A input_token.length = apr_base64_decode_len(auth_param) + 1;
3877N/A input_token.value = apr_pcalloc(r->connection->pool, input_token.length);
3877N/A
3877N/A if (input_token.value == NULL) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "apr_pcalloc() failed (not enough memory)");
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A goto end;
3877N/A }
3877N/A input_token.length = apr_base64_decode(input_token.value, auth_param);
3877N/A
3877N/A if (gss_connection->server_creds == GSS_C_NO_CREDENTIAL) {
3877N/A gss_OID_set_desc desiredMechs;
3877N/A gss_OID_desc client_mech_desc;
3877N/A gss_OID client_mechoid = &client_mech_desc;
3877N/A char *mechstr = NULL;
3877N/A
3877N/A if (!__gss_get_mech_type(client_mechoid, &input_token)) {
3877N/A mechstr = (char *)__gss_oid_to_mech(client_mechoid);
3877N/A }
3877N/A if (mechstr == NULL) {
3877N/A client_mechoid = GSS_C_NULL_OID;
3877N/A mechstr = "<unknown>";
3877N/A }
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "Client wants GSS mech: %s", mechstr);
3877N/A
3877N/A desiredMechs.count = 1;
3877N/A desiredMechs.elements = client_mechoid;
3877N/A
3877N/A /* Get creds using the mechanism that the client requested */
3877N/A ret = acquire_server_creds(r, conf, &desiredMechs,
3877N/A &gss_connection->server_creds);
3877N/A if (ret)
3877N/A goto end;
3877N/A }
3877N/A /*
3877N/A * Try to display the server creds information.
3877N/A */
3877N/A if (conf->gss_debug) {
3877N/A gss_name_t sname;
3877N/A gss_buffer_desc dname;
3877N/A
3877N/A major_status = gss_inquire_cred(&minor_status,
3877N/A gss_connection->server_creds,
3877N/A &sname, NULL, NULL, NULL);
3877N/A if (major_status == GSS_S_COMPLETE) {
3877N/A major_status = gss_display_name(&minor_status,
3877N/A sname, &dname, NULL);
3877N/A }
3877N/A if (major_status == GSS_S_COMPLETE) {
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "got server creds for: %.*s",
3877N/A (int)dname.length,
3877N/A (char *)dname.value);
3877N/A (void) gss_release_name(&minor_status, &sname);
3877N/A (void) gss_release_buffer(&minor_status, &dname);
3877N/A }
3877N/A }
3877N/A
3877N/A major_status = gss_accept_sec_context(&minor_status,
3877N/A &gss_connection->context,
3877N/A gss_connection->server_creds,
3877N/A &input_token,
3877N/A GSS_C_NO_CHANNEL_BINDINGS,
3877N/A &client_name,
3877N/A NULL,
3877N/A &output_token,
3877N/A NULL,
3877N/A NULL,
3877N/A &delegated_cred);
3877N/A
3877N/A if (output_token.length) {
3877N/A char *token = NULL;
3877N/A size_t len;
3877N/A len = apr_base64_encode_len(output_token.length) + 1;
3877N/A token = apr_pcalloc(r->connection->pool, len + 1);
3877N/A if (token == NULL) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "apr_pcalloc() failed (not enough memory)");
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A gss_release_buffer(&minor_status2, &output_token);
3877N/A goto end;
3877N/A }
3877N/A apr_base64_encode(token, output_token.value, output_token.length);
3877N/A token[len] = '\0';
3877N/A *negotiate_ret_value = token;
3877N/A }
3877N/A
3877N/A if (GSS_ERROR(major_status)) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "%s", gss_error_msg(r->pool, major_status, minor_status,
3877N/A "gss_accept_sec_context() failed"));
3877N/A /* Don't offer the Negotiate method again if call to GSS layer failed */
3877N/A *negotiate_ret_value = NULL;
3877N/A ret = HTTP_UNAUTHORIZED;
3877N/A goto end;
3877N/A }
3877N/A
3877N/A if (major_status == GSS_S_CONTINUE_NEEDED) {
3877N/A /*
3877N/A * Some GSSAPI mechanisms may require multiple iterations to
3877N/A * establish authentication. Most notably, when MUTUAL_AUTHENTICATION
3877N/A * flag is used, multiple round trips are needed.
3877N/A */
3877N/A ret = HTTP_UNAUTHORIZED;
3877N/A goto end;
3877N/A }
3877N/A
3877N/A if (client_name != GSS_C_NO_NAME) {
3877N/A gss_buffer_desc name_token = GSS_C_EMPTY_BUFFER;
3877N/A major_status = gss_display_name(&minor_status, client_name,
3877N/A &name_token, NULL);
3877N/A
3877N/A if (GSS_ERROR(major_status)) {
3877N/A log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
3877N/A "%s", gss_error_msg(r->pool, major_status,
3877N/A minor_status,
3877N/A "gss_export_name() failed"));
3877N/A ret = HTTP_INTERNAL_SERVER_ERROR;
3877N/A goto end;
3877N/A }
3877N/A if (name_token.length) {
3877N/A r->user = apr_pstrdup(r->pool, name_token.value);
3877N/A gss_release_buffer(&minor_status, &name_token);
3877N/A }
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "Authenticated user: %s",
3877N/A r->user ? r->user : "<unknown>");
3877N/A }
3877N/A r->ap_auth_type = "Negotiate";
3877N/A ret = OK;
3877N/Aend:
3877N/A if (delegated_cred)
3877N/A gss_release_cred(&minor_status, &delegated_cred);
3877N/A
3877N/A if (output_token.length)
3877N/A gss_release_buffer(&minor_status, &output_token);
3877N/A
3877N/A if (client_name != GSS_C_NO_NAME)
3877N/A gss_release_name(&minor_status, &client_name);
3877N/A
3877N/A cleanup_gss_connection(gss_connection);
3877N/A
3877N/A return ret;
3877N/A}
3877N/A
3877N/Astatic int
3877N/Aalready_succeeded(request_rec *r)
3877N/A{
3877N/A if (ap_is_initial_req(r) || r->ap_auth_type == NULL)
3877N/A return 0;
3877N/A
3877N/A return (strcmp(r->ap_auth_type, "Negotiate") ||
3877N/A (strcmp(r->ap_auth_type, "Basic") && strchr(r->user, '@')));
3877N/A}
3877N/A
3877N/Astatic void
3877N/Anote_gss_auth_failure(request_rec *r, const gss_auth_config *conf,
3877N/A char *negotiate_ret_value)
3877N/A{
3877N/A const char *auth_name = NULL;
3877N/A int set_basic = 0;
3877N/A char *negoauth_param;
3877N/A
3877N/A /* get the user realm specified in .htaccess */
3877N/A auth_name = ap_auth_name(r);
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "note_gss_auth_failure: auth_name = %s",
3877N/A auth_name ? auth_name : "<undefined>");
3877N/A
3877N/A if (negotiate_ret_value != NULL) {
3877N/A negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
3877N/A apr_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
3877N/A apr_table_add(r->err_headers_out, "WWW-Authenticate", negoauth_param);
3877N/A }
3877N/A}
3877N/A
3877N/Aint
3877N/Agss_authenticate(request_rec *r)
3877N/A{
3877N/A int ret;
3877N/A gss_auth_config *conf =
3877N/A (gss_auth_config *) ap_get_module_config(r->per_dir_config,
3877N/A &auth_gss_module);
3877N/A const char *auth_type = NULL;
3877N/A const char *auth_line = NULL;
3877N/A const char *type = NULL;
3877N/A char *negotiate_ret_value;
3877N/A static int last_return = HTTP_UNAUTHORIZED;
3877N/A
3877N/A /* get the type specified in .htaccess */
3877N/A type = ap_auth_type(r);
3877N/A
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "gss_authenticate: type = %s", type);
3877N/A
3877N/A if (type == NULL || (strcasecmp(type, "GSSAPI") != 0)) {
3877N/A return DECLINED;
3877N/A }
3877N/A
3877N/A /* get what the user sent us in the HTTP header */
3877N/A auth_line = apr_table_get(r->headers_in, "Authorization");
3877N/A
3877N/A if (!auth_line) {
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "No authentication data found");
3877N/A note_gss_auth_failure(r, conf, "\0");
3877N/A return HTTP_UNAUTHORIZED;
3877N/A }
3877N/A auth_type = ap_getword_white(r->pool, &auth_line);
3877N/A
3877N/A if (already_succeeded(r))
3877N/A return last_return;
3877N/A
3877N/A if (strcasecmp(auth_type, "Negotiate") == 0) {
3877N/A ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value);
3877N/A } else {
3877N/A ret = HTTP_UNAUTHORIZED;
3877N/A }
3877N/A
3877N/A if (ret == HTTP_UNAUTHORIZED) {
3877N/A if (conf->gss_debug)
3877N/A log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
3877N/A "Authentication failed.");
3877N/A note_gss_auth_failure(r, conf, negotiate_ret_value);
3877N/A }
3877N/A
3877N/A last_return = ret;
3877N/A return ret;
3877N/A}