Improved handling of failed GSS-API authentication attempts

Previously an attribute error occurred or a SSHException was thrown if
the GSS-API authentication failed.
If GSS-API authentication fails now or the remote host does not support
GSS-API, paramiko tries other authentication methods.

1 files changed, 8 insertions, 4 deletions

diff --git a/demos/demo_simple.py b/demos/demo_simple.py
index 100e15f5..a9d363da 100755
--- a/demos/demo_simple.py
+++ b/demos/demo_simple.py
@@ -64,7 +64,7 @@ if username == '':
     username = input('Username [%s]: ' % default_username)
     if len(username) == 0:
         username = default_username
-if not UseGSSAPI:
+if not UseGSSAPI or (not UseGSSAPI and not DoGSSAPIKeyExchange):
     password = getpass.getpass('Password for %s@%s: ' % (username, hostname))
 
 
@@ -74,13 +74,17 @@ try:
     client.load_system_host_keys()
     client.set_missing_host_key_policy(paramiko.WarningPolicy())
     print('*** Connecting...')
-    if not UseGSSAPI:
+    if not UseGSSAPI or (not UseGSSAPI and not DoGSSAPIKeyExchange):
         client.connect(hostname, Port, username, password)
     else:
         # SSPI works only with the FQDN of the target host
         hostname = socket.getfqdn(hostname)
-        client.connect(hostname, Port, username, gss_auth=UseGSSAPI,
-                       gss_kex=DoGSSAPIKeyExchange)
+        try:
+            client.connect(hostname, Port, username, gss_auth=UseGSSAPI,
+                           gss_kex=DoGSSAPIKeyExchange)
+        except Exception:
+            password = getpass.getpass('Password for %s@%s: ' % (username, hostname))
+            client.connect(hostname, Port, username, password)
     chan = client.invoke_shell()
     print(repr(client.get_transport()))
     print('*** Here we go!\n')