o Merge in OPENSSH_3_4P1_GSI_20020926.

diff --git a/openssh/auth2-gss.c b/openssh/auth2-gss.c
index 597b61404213f3a1b9aa087c32423a85b999b5cd..ddaf953eba9540ad5f8adf55651119e14478e0cd 100644 (file)
--- a/openssh/auth2-gss.c
+++ b/openssh/auth2-gss.c
@@ -144,7 +144,7 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
         
         if (GSS_ERROR(maj_status)) {
                 /* Failure <sniff> */
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(gssctxt->oid,maj_status,min_status);
                 authctxt->postponed = 0;
                dispatch_set(SSH_MSG_AUTH_GSSAPI_TOKEN, NULL);
                 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);

diff --git a/openssh/gss-genr.c b/openssh/gss-genr.c
index 5e5dc0ed2457aae915b0b9388135a4238c34b59e..ccd6d7e8558817f5eb5c9afe7acb3e317a249fd0 100644 (file)
--- a/openssh/gss-genr.c
+++ b/openssh/gss-genr.c
@@ -250,7 +250,8 @@ gss_OID ssh_gssapi_id_kex(Gssctxt *ctx, char *name) {
 
 /* All this effort to report an error ... */
 static void
-ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
+ssh_gssapi_error_ex(gss_OID mech, OM_uint32 major_status,
+                   OM_uint32 minor_status,
                    int send_packet) {
        OM_uint32 lmaj, lmin;
         gss_buffer_desc msg = {0,NULL};
@@ -261,7 +262,7 @@ ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
         do {
                lmaj = gss_display_status(&lmin, major_status,
                                          GSS_C_GSS_CODE,
-                                         GSS_C_NULL_OID,
+                                         mech,
                                          &ctx, &msg);
                if (lmaj == GSS_S_COMPLETE) {
                        debug((char *)msg.value);
@@ -274,7 +275,7 @@ ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
         do {
                lmaj = gss_display_status(&lmin, minor_status,
                                          GSS_C_MECH_CODE,
-                                         GSS_C_NULL_OID,
+                                         mech,
                                          &ctx, &msg);
                if (lmaj == GSS_S_COMPLETE) {
                        debug((char *)msg.value);
@@ -285,13 +286,14 @@ ssh_gssapi_error_ex(OM_uint32 major_status,OM_uint32 minor_status,
 }
 
 void
-ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status) {
-    ssh_gssapi_error_ex(major_status, minor_status, 0);
+ssh_gssapi_error(gss_OID mech,OM_uint32 major_status,OM_uint32 minor_status) {
+    ssh_gssapi_error_ex(mech, major_status, minor_status, 0);
 }
 
 void
-ssh_gssapi_send_error(OM_uint32 major_status,OM_uint32 minor_status) {
-    ssh_gssapi_error_ex(major_status, minor_status, 1);
+ssh_gssapi_send_error(gss_OID mech,
+                     OM_uint32 major_status,OM_uint32 minor_status) {
+    ssh_gssapi_error_ex(mech, major_status, minor_status, 1);
 }
 
 
@@ -380,7 +382,7 @@ ssh_gssapi_init_ctx(Gssctxt *ctx, int deleg_creds, gss_buffer_desc *recv_tok,
                                        NULL);
        ctx->status=maj_status;
        if (GSS_ERROR(maj_status)) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(ctx->oid,maj_status,min_status);
        }
        return(maj_status);
 }
@@ -394,7 +396,6 @@ OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *ctx,gss_buffer_desc *recv_tok,
                                gss_buffer_desc *send_tok, OM_uint32 *flags) 
 {
        OM_uint32 maj_status, min_status;
-       gss_OID mech;
        
        maj_status=gss_accept_sec_context(&min_status,
                                          &ctx->context,
@@ -402,13 +403,13 @@ OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *ctx,gss_buffer_desc *recv_tok,
                                          recv_tok,
                                          GSS_C_NO_CHANNEL_BINDINGS,
                                          &ctx->client,
-                                         &mech,
+                                         &ctx->oid,
                                          send_tok,
                                          flags,
                                          NULL,
                                          &ctx->client_creds);
        if (GSS_ERROR(maj_status)) {
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(ctx->oid,maj_status,min_status);
        }
        
        if (ctx->client_creds) {
@@ -469,7 +470,7 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host) {
                                        &gssbuf,
                                         GSS_C_NT_HOSTBASED_SERVICE,
                                         &ctx->name))) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(ctx->oid, maj_status,min_status);
        }
        
        xfree(xhost);
@@ -506,7 +507,7 @@ ssh_gssapi_acquire_cred(Gssctxt *ctx) {
                                    &ctx->creds,
                                    NULL,
                                    NULL))) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(GSS_C_NO_OID,maj_status,min_status);
        }
                                
        gss_release_oid_set(&min_status, &oidset);
@@ -524,7 +525,7 @@ ssh_gssapi_getclient(Gssctxt *ctx, enum ssh_gss_id *type,
        
        *type=ssh_gssapi_get_ctype(ctx);
        if ((maj_status=gss_display_name(&min_status,ctx->client,name,NULL))) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(GSS_C_NO_OID,maj_status,min_status);
        }
        
        /* This is icky. There appears to be no way to copy this structure,
@@ -549,13 +550,13 @@ ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *buffer, gss_buffer_desc *hash) {
                                        buffer,
                                        NULL,
                                        hash)))
-                       ssh_gssapi_error(maj_status,min_status);
+                       ssh_gssapi_error(ctx->oid,maj_status,min_status);
        }
        else
 
        if ((maj_status=gss_get_mic(&min_status,ctx->context,
                                    GSS_C_QOP_DEFAULT, buffer, hash))) {
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(ctx->oid,maj_status,min_status);
        }
        
        return(maj_status);

diff --git a/openssh/gss-serv.c b/openssh/gss-serv.c
index 53321ace45dedaddff3b7f1ccad01b2ab804d3ad..84a7546aae73f6f863fd1efe25e27b3f1c1d70b3 100644 (file)
--- a/openssh/gss-serv.c
+++ b/openssh/gss-serv.c
@@ -244,7 +244,8 @@ ssh_gssapi_krb5_storecreds(gss_buffer_t export_buffer) {
                                               krb5_cred_handle, 
                                               ccache))) {
                log("gss_krb5_copy_ccache() failed");
-               ssh_gssapi_error(maj_status,min_status);
+               ssh_gssapi_error(&supported_mechs[GSS_KERBEROS].oid,
+                                maj_status,min_status);
                krb5_cc_destroy(krb_context,ccache);
                return GSS_S_FAILURE;
        }
@@ -438,7 +439,7 @@ ssh_gssapi_storecreds()
        maj_stat = gss_export_cred(&min_stat, gssapi_client_creds,
                                   GSS_C_NO_OID, 1, &export_cred);
        if (GSS_ERROR(maj_stat) && maj_stat != GSS_S_UNAVAILABLE) {
-               ssh_gssapi_error(maj_stat, min_stat);
+               ssh_gssapi_error(GSS_C_NO_OID, maj_stat, min_stat);
                return;
        }
 #endif
@@ -448,7 +449,7 @@ ssh_gssapi_storecreds()
            ssh_gssapi_export_cred(&min_stat, gssapi_client_creds,
                                   GSS_C_NO_OID, 1, &export_cred);
            if (GSS_ERROR(maj_stat)) {
-               ssh_gssapi_error(maj_stat, min_stat);
+               ssh_gssapi_error(GSS_C_NO_OID, maj_stat, min_stat);
            }
        }
 
@@ -460,6 +461,11 @@ ssh_gssapi_storecreds()
                return;
        }
        *p++ = '\0';
+#ifdef GSI
+       if (strcmp((char *)export_cred.value,"X509_USER_DELEG_PROXY") == 0)
+           gssapi_cred_store.envvar = strdup("X509_USER_PROXY");
+       else
+#endif
        gssapi_cred_store.envvar = strdup((char *)export_cred.value);
        gssapi_cred_store.envval = strdup(p);
 #ifdef USE_PAM

diff --git a/openssh/kexgss.c b/openssh/kexgss.c
index da96461276202bc7fb2a5cb395d1ddaa1e97f509..7d18b1a28bbf4b5c2987edb461ad84ab9b901154 100644 (file)
--- a/openssh/kexgss.c
+++ b/openssh/kexgss.c
@@ -371,18 +371,18 @@ kexgss_server(Kex *kex)
        } while (maj_status & GSS_S_CONTINUE_NEEDED);
 
        if (GSS_ERROR(maj_status)) {
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(ctxt->oid,maj_status,min_status);
                packet_disconnect("gssapi key exchange handshake failed");
        }
 
        debug("gss_complete");
        if (!(ret_flags & GSS_C_MUTUAL_FLAG)) {
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(ctxt->oid,maj_status,min_status);
                packet_disconnect("gssapi mutual authentication failed");
        }
                
        if (!(ret_flags & GSS_C_INTEG_FLAG)) {
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(ctxt->oid,maj_status,min_status);
                packet_disconnect("gssapi channel integrity not established");
        }               
        
@@ -423,7 +423,7 @@ kexgss_server(Kex *kex)
        gssbuf.length = 20; /* Hashlen appears to always be 20 */
        
        if (GSS_ERROR(PRIVSEP(ssh_gssapi_sign(ctxt,&gssbuf,&msg_tok)))) {
-               ssh_gssapi_send_error(maj_status,min_status);
+               ssh_gssapi_send_error(ctxt->oid,maj_status,min_status);
                packet_disconnect("Couldn't get MIC");
        }
        

diff --git a/openssh/ssh-gss.h b/openssh/ssh-gss.h
index 37d8721d3a916e58fdb1e5123c34e9300ce0b82a..31e025ecb8a56861755b37b42e10b211cf258b7f 100644 (file)
--- a/openssh/ssh-gss.h
+++ b/openssh/ssh-gss.h
@@ -79,7 +79,7 @@ typedef struct {
        OM_uint32       status; /* both */
        gss_ctx_id_t    context; /* both */
        gss_name_t      name; /* both */
-       gss_OID         oid; /* client */
+       gss_OID         oid; /* both */
        gss_cred_id_t   creds; /* server */
        gss_name_t      client; /* server */
        gss_cred_id_t   client_creds; /* server */
@@ -110,8 +110,10 @@ OM_uint32 ssh_gssapi_getclient(Gssctxt *ctx,
                                enum ssh_gss_id *type,
                                gss_buffer_desc *name,
                                gss_cred_id_t *creds);
-void ssh_gssapi_error(OM_uint32 major_status,OM_uint32 minor_status);
-void ssh_gssapi_send_error(OM_uint32 major_status,OM_uint32 minor_status);
+void ssh_gssapi_error(gss_OID mech,
+                     OM_uint32 major_status, OM_uint32 minor_status);
+void ssh_gssapi_send_error(gss_OID mech,
+                          OM_uint32 major_status,OM_uint32 minor_status);
 void ssh_gssapi_build_ctx(Gssctxt **ctx);
 void ssh_gssapi_delete_ctx(Gssctxt **ctx);
 OM_uint32 ssh_gssapi_client_ctx(Gssctxt **ctx,gss_OID oid,char *host);

diff --git a/openssh/sshconnect1.c b/openssh/sshconnect1.c
index 605658ba367a4a5a85f92107906c7b402bcc0341..86e0e3e1452244a10e4f6f430a7d6d2af1656592 100644 (file)
--- a/openssh/sshconnect1.c
+++ b/openssh/sshconnect1.c
@@ -959,80 +959,33 @@ try_password_authentication(char *prompt)
 }
 
 #ifdef GSSAPI
-/*
- * This code stolen from the gss-client.c sample program from MIT's
- * kerberos 5 distribution.
- */
-
-gss_cred_id_t gss_cred = GSS_C_NO_CREDENTIAL;
-
-static void display_status_1(m, code, type)
- char *m;
- OM_uint32 code;
- int type;
-{
-  OM_uint32 maj_stat, min_stat;
-  gss_buffer_desc msg;
-  OM_uint32 msg_ctx;
-
-  msg_ctx = 0;
-  while (1) {
-    maj_stat = gss_display_status(&min_stat, code,
-                                  type, GSS_C_NULL_OID,
-                                  &msg_ctx, &msg);
-    debug("GSS-API error %s: %s", m, (char *)msg.value);
-    (void) gss_release_buffer(&min_stat, &msg);
-
-    if (!msg_ctx)
-      break;
-  }
-}
-
-static void display_gssapi_status(msg, maj_stat, min_stat)
-  char *msg;
-  OM_uint32 maj_stat;
-  OM_uint32 min_stat;
-{
-  display_status_1(msg, maj_stat, GSS_C_GSS_CODE);
-  display_status_1(msg, min_stat, GSS_C_MECH_CODE);
-}
-
 #ifdef GSI
-int get_gssapi_cred()
+char * get_gsi_name()
 {
   OM_uint32 maj_stat;
   OM_uint32 min_stat;
+  gss_name_t pname = GSS_C_NO_NAME;
+  gss_buffer_desc tmpname;
+  gss_buffer_t tmpnamed = &tmpname;
+  char *retname;
+  gss_OID_set oidset;
+  gss_cred_id_t gss_cred = GSS_C_NO_CREDENTIAL;
 
-
-  debug("calling gss_acquire_cred");
+  gss_create_empty_oid_set(&min_stat,&oidset);
+  gss_add_oid_set_member(&min_stat,&supported_mechs[GSS_GSI].oid,&oidset);
   maj_stat = gss_acquire_cred(&min_stat,
                               GSS_C_NO_NAME,
                               GSS_C_INDEFINITE,
-                              GSS_C_NO_OID_SET,
+                              oidset,
                               GSS_C_INITIATE,
                               &gss_cred,
                               NULL,
                               NULL);
 
   if (maj_stat != GSS_S_COMPLETE) {
-    display_gssapi_status("Failuring acquiring GSSAPI credentials",
-                          maj_stat, min_stat);
-    gss_cred = GSS_C_NO_CREDENTIAL; /* should not be needed */
-    return 0;
+      goto error;
   }
 
-  return 1;     /* Success */
-}
-
-char * get_gss_our_name()
-{
-  OM_uint32 maj_stat;
-  OM_uint32 min_stat;
-  gss_name_t pname = GSS_C_NO_NAME;
-  gss_buffer_desc tmpname;
-  gss_buffer_t tmpnamed = &tmpname;
-  char *retname;
-
   debug("calling gss_inquire_cred");
   maj_stat = gss_inquire_cred(&min_stat,
                               gss_cred,
@@ -1041,7 +994,7 @@ char * get_gss_our_name()
                               NULL,
                               NULL);
   if (maj_stat != GSS_S_COMPLETE) {
-    return NULL;
+      goto error;
   }
 
   maj_stat = gss_display_name(&min_stat,
@@ -1049,12 +1002,12 @@ char * get_gss_our_name()
                              tmpnamed,
                              NULL);
   if (maj_stat != GSS_S_COMPLETE) {
-     return NULL;
+      goto error;
   }
   debug("gss_display_name finsished");
   retname = (char *)malloc(tmpname.length + 1);
   if (!retname) {
-    return NULL;
+      goto error;
   }
   memcpy(retname, tmpname.value, tmpname.length);
   retname[tmpname.length] = '\0';
@@ -1063,6 +1016,11 @@ char * get_gss_our_name()
   gss_release_buffer(&min_stat, tmpnamed);
 
   return retname;
+
+ error:
+  debug("Failed to set GSI username from credentials");
+  ssh_gssapi_error(&supported_mechs[GSS_GSI].oid, maj_stat, min_stat);
+  return NULL;
 }
 #endif /* GSI */
 
@@ -1077,17 +1035,17 @@ int try_gssapi_authentication(char *host, Options *options)
   gss_ctx_id_t gss_context;
   gss_OID_desc mech_oid;
   gss_OID name_type;
-  gss_OID_set my_mechs;
-  int my_mech_num;
+  gss_OID_set gss_mechs, my_mechs;
+  int my_mech_num, i, present;
   OM_uint32 maj_stat;
   OM_uint32 min_stat;
   int ret_stat = 0;                             /* 1 == success */
   OM_uint32 req_flags = 0;
   OM_uint32 ret_flags;
   int type;
-  char *gssapi_auth_type = NULL;
   char *xhost;
   unsigned int slen;
+  Gssctxt *ctx = NULL;
 
   /* Make a copy of the host name, in case it was returned by a
    * previous call to gethostbyname(). */      
@@ -1109,25 +1067,6 @@ int try_gssapi_authentication(char *host, Options *options)
   /* Do mutual authentication */
   req_flags |= GSS_C_MUTUAL_FLAG;
 
-#ifdef KRB5
-
-  gssapi_auth_type = "GSSAPI/Kerberos 5";
-
-#endif
-
-#ifdef GSI
-
-  gssapi_auth_type = "GSSAPI/GLOBUS";
-
-#endif /* GSI */
-
-  if (gssapi_auth_type == NULL) {
-      debug("No GSSAPI type defined during compile");
-      goto cleanup;
-  }
-
-  debug("Attempting %s authentication", gssapi_auth_type);
-
   service_name = (char *) xmalloc(strlen("host") +
                                  strlen(xhost) +
                                  2 /* 1 for '@', 1 for NUL */);
@@ -1143,26 +1082,11 @@ int try_gssapi_authentication(char *host, Options *options)
 
   /* Forward credentials? */
 
-#ifdef KRB5
-  if (options->kerberos_tgt_passing) {
-      debug("Forwarding Kerberos credentials");
-      req_flags |= GSS_C_DELEG_FLAG;
-  }
-#endif /* KRB5 */
-
 #ifdef GSSAPI
   if(options->gss_deleg_creds) {
-    debug("Forwarding X509 proxy certificate");
+    debug("Delegating GSSAPI credentials");
     req_flags |= GSS_C_DELEG_FLAG;
   }
-#ifdef GSS_C_GLOBUS_LIMITED_DELEG_PROXY_FLAG
-  /* Forward limited credentials, overrides gss_deleg_creds */
-  if(options->gss_globus_deleg_limited_proxy) {
-    debug("Forwarding limited X509 proxy certificate");
-    req_flags |= (GSS_C_DELEG_FLAG | GSS_C_GLOBUS_LIMITED_DELEG_PROXY_FLAG);
-  }
-#endif /* GSS_C_GLOBUS_LIMITED_DELEG_PROXY_FLAG */
-
 #endif /* GSSAPI */
 
   debug("req_flags = %u", (unsigned int)req_flags);
@@ -1176,27 +1100,71 @@ int try_gssapi_authentication(char *host, Options *options)
   service_name = NULL;
 
   if (maj_stat != GSS_S_COMPLETE) {
-    display_gssapi_status("importing service name", maj_stat, min_stat);
+    ssh_gssapi_error(GSS_C_NO_OID, maj_stat, min_stat);
     goto cleanup;
   }
 
-  maj_stat = gss_indicate_mechs(&min_stat, &my_mechs);
+  maj_stat = gss_indicate_mechs(&min_stat, &gss_mechs);
 
   if (maj_stat != GSS_S_COMPLETE) {
-    display_gssapi_status("indicating mechs", maj_stat, min_stat);
+    ssh_gssapi_error(GSS_C_NO_OID, maj_stat, min_stat);
     goto cleanup;
   }
 
+  /* The GSSAPI supports the mechs in gss_mechs, but which ones do
+     we have credentials for?  We only get one try, so we don't want
+     to propose a mechanism we know is going to fail. */
+  maj_stat = gss_create_empty_oid_set(&min_stat, &my_mechs);
+  for (i=0; supported_mechs[i].name != NULL; i++) {
+      maj_stat = gss_test_oid_set_member(&min_stat, &supported_mechs[i].oid,
+                                        gss_mechs, &present);
+      if (present) {
+         if (!GSS_ERROR(ssh_gssapi_client_ctx(&ctx, &supported_mechs[i].oid,
+                                              host))) {
+             maj_stat = gss_add_oid_set_member(&min_stat,
+                                               &supported_mechs[i].oid,
+                                               &my_mechs);
+             debug("GSSAPI mechanism %s supported", supported_mechs[i].name);
+         } else {
+             debug("no credentials for GSSAPI mechanism %s",
+                   supported_mechs[i].name);
+         }
+      } else {
+         debug("GSSAPI mechanism %s not supported", supported_mechs[i].name);
+      }
+  }
+
   /*
    * Send over a packet to the daemon, letting it know we're doing
    * GSSAPI and our mech_oid(s).
    */
-  debug("Sending mech oid to server");
+  debug("Sending mech oid(s) to server");
   packet_start(SSH_CMSG_AUTH_GSSAPI);
   packet_put_int(my_mechs->count); /* Number of mechs we're sending */
-  for (my_mech_num = 0; my_mech_num < my_mechs->count; my_mech_num++)
+#ifdef GSI
+  /* Send GSI before Kerberos, because if GSI fails, we can always fall
+     back and try regular Kerberos authentication with our Kerberos cred. */
+  maj_stat = gss_test_oid_set_member(&min_stat, &supported_mechs[GSS_GSI].oid,
+                                    my_mechs, &present);
+  if (present) {
+      packet_put_string(supported_mechs[GSS_GSI].oid.elements,
+                        supported_mechs[GSS_GSI].oid.length);
+  }
+#endif
+  for (my_mech_num = 0; my_mech_num < my_mechs->count; my_mech_num++) {
+#ifdef GSI
+      /* Skip GSI.  We already sent it above. */
+      if ((my_mechs->elements[my_mech_num].length ==
+          supported_mechs[GSS_GSI].oid.length) &&
+         memcmp(my_mechs->elements[my_mech_num].elements,
+                supported_mechs[GSS_GSI].oid.elements,
+                my_mechs->elements[my_mech_num].length) == 0) {
+         continue;
+      }
+#endif
       packet_put_string(my_mechs->elements[my_mech_num].elements,
                         my_mechs->elements[my_mech_num].length);
+  }
   packet_send();
   packet_write_wait();
 
@@ -1250,7 +1218,7 @@ int try_gssapi_authentication(char *host, Options *options)
   do {
     maj_stat =
       gss_init_sec_context(&min_stat,
-                           gss_cred,
+                           GSS_C_NO_CREDENTIAL,
                            &gss_context,
                            target_name,
                            &mech_oid,
@@ -1267,7 +1235,7 @@ int try_gssapi_authentication(char *host, Options *options)
       (void) gss_release_buffer(&min_stat, &recv_tok);
 
     if (maj_stat != GSS_S_COMPLETE && maj_stat != GSS_S_CONTINUE_NEEDED) {
-      display_gssapi_status("initializing context", maj_stat, min_stat);
+      ssh_gssapi_error(&mech_oid, maj_stat, min_stat);
 
       /* Send an abort message */
       packet_start(SSH_MSG_AUTH_GSSAPI_ABORT);
@@ -1321,7 +1289,7 @@ int try_gssapi_authentication(char *host, Options *options)
   /* Success */
   ret_stat = 1;
 
-  debug("%s authentication successful", gssapi_auth_type);
+  debug("GSSAPI authentication successful");
 
   /*
    * Read hash of host and server keys and make sure it
@@ -1355,8 +1323,7 @@ int try_gssapi_authentication(char *host, Options *options)
                           &qop_state);
 
     if (maj_stat != GSS_S_COMPLETE) {
-      display_gssapi_status("unwraping SSHD key hash",
-                            maj_stat, min_stat);
+      ssh_gssapi_error(&mech_oid, maj_stat, min_stat);
       packet_disconnect("Verification of SSHD keys through GSSAPI-secured channel failed: "
                         "Unwrapping of hash failed.");
     }
@@ -1649,14 +1616,13 @@ ssh_userauth1(const char *local_user, const char *server_user, char *host,
    */
   if ((supported_authentications & (1 << SSH_AUTH_GSSAPI)) &&
       options.gss_authentication) {
-    if (get_gssapi_cred()) {
       char * retname;
       char * newname;
 
 
       save_server_user = server_user;
 
-      retname = get_gss_our_name();
+      retname = get_gsi_name();
 
       if (retname) {
         debug("passing gssapi name '%s'", retname);
@@ -1675,14 +1641,7 @@ ssh_userauth1(const char *local_user, const char *server_user, char *host,
           }
         }
       }
-    } else {
-      /*
-       * If we couldn't successfully get our GSSAPI credentials then
-       * turn off gssapi authentication
-       */
-      options.gss_authentication = 0;
-    }
-    debug("server_user %s", server_user);
+      debug("server_user %s", server_user);
   }
 #endif /* GSI */
 #endif /* GSSAPI */