[plasma/krdp] src: Fix NLA authentication

Git commit 7a803ab9b33cf6a96130a484a853525e10284006 by David Edmundson.
Committed on 06/08/2026 at 10:04.
Pushed by davidedmundson into branch 'master'.

Fix NLA authentication

The point of NLA authentication is the password is never sent, but a
hashed version is compared by RDP against the SAM database.

In this case we don't want to try checking the passwords ourselves

Ammends a5c6f5470cf75f27054296bf1a4aa3893006549f

M  +20   -19   src/RdpConnection.cpp

https://invent.kde.org/plasma/krdp/-/commit/7a803ab9b33cf6a96130a484a853525e10284006

diff --git a/src/RdpConnection.cpp b/src/RdpConnection.cpp
index 043270d..d916774 100644
--- a/src/RdpConnection.cpp
+++ b/src/RdpConnection.cpp
@@ -399,11 +399,12 @@ void RdpConnection::initialize()
 
     if (!usePamAuthentication) {
         if (!createSamFile(d->samFile, d->server->users())) {
+            qFatal("Failed to create SAM database");
             return;
         }
 
         if (!freerdp_settings_set_string(settings, FreeRDP_NtlmSamFile, d->samFile.fileName().toUtf8().constData())) {
-            qCWarning(KRDP) << "Failed to set SAM database";
+            qFatal("Failed to set SAM database");
             return;
         }
     }
@@ -601,15 +602,14 @@ bool RdpConnection::onPostConnect()
     d->samFile.remove();
 
     rdpSettings *settings = d->peer->context->settings;
-
-    if (!freerdp_settings_set_bool(settings, FreeRDP_AutoLogonEnabled, true)) {
-        return false;
-    }
-
     const QString username = QString::fromLatin1(freerdp_settings_get_string(settings, FreeRDP_Username));
-    const QString password = QString::fromLatin1(freerdp_settings_get_string(settings, FreeRDP_Password));
 
     if (d->server->usePAMAuthentication()) {
+        if (!freerdp_settings_set_bool(settings, FreeRDP_AutoLogonEnabled, true)) {
+            return false;
+        }
+
+        const QString password = QString::fromLatin1(freerdp_settings_get_string(settings, FreeRDP_Password));
         qCDebug(KRDP) << "Attempting authenticating user with PAM";
         if (username == KUser().loginName() || KUser().loginName() == QStringLiteral("plasmalogin")) {
             if (pamAuthenticate(username, password) >= 0) {
@@ -617,20 +617,21 @@ bool RdpConnection::onPostConnect()
                 return true;
             }
         }
-    }
-
-    const auto users = d->server->users();
-    for (auto user : users) {
-        if (user.password.isEmpty()) {
-            return false;
-        }
-        if (user.name == username && user.password == password) {
-            qCDebug(KRDP) << "User" << username << "authenticated successfully";
-            return true;
+        const auto users = d->server->users();
+        for (auto user : users) {
+            if (user.password.isEmpty()) {
+                return false;
+            }
+            if (user.name == username && user.password == password) {
+                qCDebug(KRDP) << "User" << username << "authenticated successfully";
+                return true;
+            }
         }
+        return false;
+    } else {
+        // In the NLA case the user has been authorised against the SAM database
+        return true;
     }
-
-    return false;
 }
 
 bool RdpConnection::onClose()