From 87014d4afb3229813f4a61ab30fc7afd778e3fb4 Mon Sep 17 00:00:00 2001
From: Marc-Andre Lureau <marcandre.lureau@redhat.com>
Date: Mon, 28 Oct 2024 16:19:33 +0400
Subject: [PATCH] fix(acceptor): raise credssp error to caller (#563)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Co-authored-by: Benoît Cortier <bcortier@proton.me>
---
 crates/ironrdp-acceptor/src/lib.rs | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/crates/ironrdp-acceptor/src/lib.rs b/crates/ironrdp-acceptor/src/lib.rs
index db6877ed..df38f91f 100644
--- a/crates/ironrdp-acceptor/src/lib.rs
+++ b/crates/ironrdp-acceptor/src/lib.rs
@@ -172,16 +172,17 @@ where
         Ok(())
     }
 
-    let result = match credssp_loop(framed, acceptor, buf, client_computer_name, public_key, kerberos_config).await {
-        Ok(_) => EarlyUserAuthResult::Success,
-        Err(err) => {
-            warn!("credssp: {err}");
-            EarlyUserAuthResult::AccessDenied
-        }
-    };
+    let result = credssp_loop(framed, acceptor, buf, client_computer_name, public_key, kerberos_config).await;
 
     if protocol.intersects(nego::SecurityProtocol::HYBRID_EX) {
         trace!(?result, "HYBRID_EX");
+
+        let result = if result.is_ok() {
+            EarlyUserAuthResult::Success
+        } else {
+            EarlyUserAuthResult::AccessDenied
+        };
+
         buf.clear();
         result
             .to_buffer(&mut *buf)
@@ -192,6 +193,9 @@ where
             .await
             .map_err(|e| ironrdp_connector::custom_err!("write all", e))?;
     }
+
+    result?;
+
     acceptor.mark_credssp_as_done();
 
     Ok(())