|
|
On Tue, Aug 15, 2006 at 03:34:07PM +0200, Michael Adam wrote:
> For krb5, there is the problem, that all four bytes of the error
> code are used by the kerbers error tables. But this is should be
> no problem since there are not many krb5 error codes in total
> (around 350); they could be mapped into the 3 free bytes of an
> NTSTATUS.
Just found the comment above the function ads_ntstatus():
/*
do a rough conversion between ads error codes and NT status codes
we'll need to fill this in more
*/
I think this supports going with NTSTATUS even a bit more,
even without using the trick to hide Kerberos codes directly
in NTSTATUS.
We can always do this, but for the important Kerberos/GSSAPI
error codes we can do manual translation. In particular as
Michael has found that nterr.h has a
NT_STATUS_TIME_DIFFERENCE_AT_DC which is just handy for the
important CLOCK_SKEW error.
Volker
|
|