From a78c61a4bf5b7eb90b0945d94568b7b3b1f23c6e Mon Sep 17 00:00:00 2001 From: Steve Holme Date: Sun, 21 Aug 2016 11:56:23 +0100 Subject: sasl: Don't use GSSAPI authentication when domain name not specified Only choose the GSSAPI authentication mechanism when the user name contains a Windows domain name or the user is a valid UPN. Fixes #718 --- lib/curl_sasl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'lib/curl_sasl.c') diff --git a/lib/curl_sasl.c b/lib/curl_sasl.c index 68a0b9320..65fa52932 100644 --- a/lib/curl_sasl.c +++ b/lib/curl_sasl.c @@ -288,7 +288,8 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct connectdata *conn, } else if(conn->bits.user_passwd) { #if defined(USE_KERBEROS5) - if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported()) { + if((enabledmechs & SASL_MECH_GSSAPI) && Curl_auth_is_gssapi_supported() && + Curl_auth_user_contains_domain(conn->user)) { sasl->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */ mech = SASL_MECH_STRING_GSSAPI; state1 = SASL_GSSAPI; -- cgit v1.2.3