1 files changed, 14 insertions, 3 deletions

diff --git a/auth2.c b/auth2.c
index b1a4e3635..6a1653064 100644
--- a/auth2.c
+++ b/auth2.c
@@ -64,6 +64,7 @@ extern Authmethod method_passwd;
 extern Authmethod method_kbdint;
 extern Authmethod method_hostbased;
 #ifdef GSSAPI
+extern Authmethod method_gsskeyex;
 extern Authmethod method_gssapi;
 #endif
 
@@ -71,6 +72,7 @@ Authmethod *authmethods[] = {
         &method_none,
         &method_pubkey,
 #ifdef GSSAPI
+        &method_gsskeyex,
         &method_gssapi,
 #endif
         &method_passwd,
@@ -141,7 +143,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 {
         Authctxt *authctxt = ctxt;
         Authmethod *m = NULL;
-        char *user, *service, *method, *style = NULL;
+        char *user, *service, *method, *style = NULL, *role = NULL;
         int authenticated = 0;
 
         if (authctxt == NULL)
@@ -153,8 +155,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
 
+        if ((role = strchr(user, '/')) != NULL)
+                *role++ = 0;
+
         if ((style = strchr(user, ':')) != NULL)
                 *style++ = 0;
+        else if (role && (style = strchr(role, ':')) != NULL)
+                *style++ = '\0';
 
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
@@ -178,8 +185,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
+                authctxt->role = role ? xstrdup(role) : NULL;
                 if (use_privsep)
-                        mm_inform_authserv(service, style);
+                        mm_inform_authserv(service, style, role);
         } else if (strcmp(user, authctxt->user) != 0 ||
             strcmp(service, authctxt->service) != 0) {
                 packet_disconnect("Change of username or service not allowed: "
@@ -195,6 +203,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 #endif
 
         authctxt->postponed = 0;
+        authctxt->server_caused_failure = 0;
 
         /* try to authenticate user */
         m = authmethod_lookup(method);
@@ -265,7 +274,9 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
                 /* now we can break out */
                 authctxt->success = 1;
         } else {
-                if (authctxt->failures++ > options.max_authtries) {
+                /* Dont count server configuration issues against the client */
+                if (!authctxt->server_caused_failure && 
+                    authctxt->failures++ > options.max_authtries) {
 #ifdef SSH_AUDIT_EVENTS
                         PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES));
 #endif