gensec returns the wrong error to kerberos errors like Ticket Expired and clock skew issues

[Jeremy Allison]

On Wed, Nov 04, 2015 at 11:14:50AM -0800, Richard Sharpe wrote:
> On Wed, Nov 4, 2015 at 10:22 AM, Jeremy Allison <jra at samba.org> wrote:
> > On Wed, Nov 04, 2015 at 10:00:48AM -0800, Richard Sharpe wrote:
> >> Hi folks,
> >>
> >> A capture I have indicates that when a Windows server gets a
> >> KRB5KRB_AP_ERR_TKT_EXPIRED error it returns
> >> STATUS_MORE_PROCESSING_REQUIRED along with an SPNEGO negTokenTarg with
> >> the Kerberos error blob in it.
> >>
> >> Samba, and it looks like gensec, folds that down to LOGON_FAILED,
> >> which makes it very hard for admins to figure out what the real error
> >> is.
> >>
> >> Is there a bugzilla on this?
> >>
> >> If I get a chance I will try to provide a fix.
> >
> > I think that is intentional in order to prevent
> > username guessing attacks.
> 
> That doesn't even pass the smell test. The KDC is responsible for
> preventing password guessing games.

Sure, but smbd is also. Remember we have our own passdb
code which has to implement the same protections.

However, I haven't looked at that bit of gensec recently
so you may be right here :-).