Fix channel binding

tvdijen · tvdijen · commit b2c3ffc801ab · 2024-06-19T11:28:27.000+02:00
diff --git a/src/Auth/Source/Negotiate.php b/src/Auth/Source/Negotiate.php
@@ -178,7 +178,7 @@ public function authenticate(array &$state): void
                             }
                         }
 
-                        if ($reply === null) {
+                        if (!$auth->isChannelBound()) {
                             throw new Error\Exception(
                                 'Negotiate - authenticate(): Failed to perform channel binding using '
                                 . 'any of the configured certificate hashes.',
@@ -248,7 +248,7 @@ public function authenticate(array &$state): void
 
     private function doAuthentication(KRB5NegotiateAuth $auth, string $hash = null): bool
     {
-        if ($this->enforceChannelBinding === true && (($hash === null) || ($auth->isChannelBound() === false))) {
+        if ($this->enforceChannelBinding === true && ($hash === null)) {
             throw new Error\Exception(
                 'Negotiate - doAuthenticate(): Channel binding is required, but the client '
                 . 'did not provide binding info.',

Original file line number	Diff line number	Diff line change
`@@ -178,7 +178,7 @@ public function authenticate(array &$state): void`
`178`	`178`	`}`
`179`	`179`	`}`
`180`	`180`
`181`		`- if ($reply === null) {`
	`181`	`+ if (!$auth->isChannelBound()) {`
`182`	`182`	`throw new Error\Exception(`
`183`	`183`	`'Negotiate - authenticate(): Failed to perform channel binding using '`
`184`	`184`	`. 'any of the configured certificate hashes.',`
`@@ -248,7 +248,7 @@ public function authenticate(array &$state): void`
`248`	`248`
`249`	`249`	`private function doAuthentication(KRB5NegotiateAuth $auth, string $hash = null): bool`
`250`	`250`	`{`
`251`		`- if ($this->enforceChannelBinding === true && (($hash === null) \|\| ($auth->isChannelBound() === false))) {`
	`251`	`+ if ($this->enforceChannelBinding === true && ($hash === null)) {`
`252`	`252`	`throw new Error\Exception(`
`253`	`253`	`'Negotiate - doAuthenticate(): Channel binding is required, but the client '`
`254`	`254`	`. 'did not provide binding info.',`