static int nla_client_init(rdpNla* nla)
{
	char* spn;
	size_t length;
	rdpTls* tls = NULL;
	rdpSettings* settings;

	WINPR_ASSERT(nla);
	WINPR_ASSERT(nla->rdpcontext);

	settings = nla->rdpcontext->settings;
	WINPR_ASSERT(settings);

	nla_set_state(nla, NLA_STATE_INITIAL);

	if (settings->RestrictedAdminModeRequired)
		settings->DisableCredentialsDelegation = TRUE;

	if (!nla_setup_kerberos(nla))
		return -1;

	if (!nla_adjust_settings_from_smartcard(nla))
		return -1;

	if (!nla_client_setup_identity(nla))
		return -1;

	tls = transport_get_tls(nla->transport);

	if (!tls)
	{
		WLog_ERR(TAG, "Unknown NLA transport layer");
		return -1;
	}

	if (!nla_sec_buffer_alloc_from_data(&nla->PublicKey, tls->PublicKey, 0, tls->PublicKeyLength))
	{
		WLog_ERR(TAG, "Failed to allocate sspi secBuffer");
		return -1;
	}

	length = sizeof(TERMSRV_SPN_PREFIX) + strlen(settings->ServerHostname);
	spn = (SEC_CHAR*)malloc(length + 1);

	if (!spn)
		return -1;

	sprintf_s(spn, length + 1, "%s%s", TERMSRV_SPN_PREFIX, settings->ServerHostname);
#ifdef UNICODE
	nla->ServicePrincipalName = NULL;
	ConvertToUnicode(CP_UTF8, 0, spn, -1, &nla->ServicePrincipalName, 0);
	free(spn);
#else
	nla->ServicePrincipalName = spn;
#endif

	if (!nla_sspi_module_init(nla))
		return -1;

	nla->status = nla_update_package_name(nla);
	if (nla->status != SEC_E_OK)
		return -1;

	WLog_DBG(TAG, "%s %" PRIu32 " : packageName=%s ; cbMaxToken=%" PRIu32, __FUNCTION__, __LINE__,
	         nla->packageName, nla->cbMaxToken);
	nla->status = nla->table->AcquireCredentialsHandle(NULL, NLA_PKG_NAME, SECPKG_CRED_OUTBOUND,
	                                                   NULL, nla->identity, NULL, NULL,
	                                                   &nla->credentials, &nla->expiration);

	if (nla->status != SEC_E_OK)
	{
		WLog_ERR(TAG, "AcquireCredentialsHandle status %s [0x%08" PRIX32 "]",
		         GetSecurityStatusString(nla->status), nla->status);
		return -1;
	}

	if (!nla_client_init_cred_handle(nla))
		return -1;

	nla->haveContext = FALSE;
	nla->haveInputBuffer = FALSE;
	nla->havePubKeyAuth = FALSE;

	ZeroMemory(&nla->ContextSizes, sizeof(SecPkgContext_Sizes));
	/*
	 * from tspkg.dll: 0x00000132
	 * ISC_REQ_MUTUAL_AUTH
	 * ISC_REQ_CONFIDENTIALITY
	 * ISC_REQ_USE_SESSION_KEY
	 * ISC_REQ_ALLOCATE_MEMORY
	 */
	nla->fContextReq = ISC_REQ_MUTUAL_AUTH | ISC_REQ_CONFIDENTIALITY;
	return 1;
}
static int nla_client_init(rdpNla* nla)
{
	char* spn;
	size_t length;
	rdpTls* tls = NULL;
	rdpSettings* settings;

	WINPR_ASSERT(nla);
	WINPR_ASSERT(nla->rdpcontext);

	settings = nla->rdpcontext->settings;
	WINPR_ASSERT(settings);

	nla_set_state(nla, NLA_STATE_INITIAL);

	if (settings->RestrictedAdminModeRequired)
		settings->DisableCredentialsDelegation = TRUE;

	if (!nla_setup_kerberos(nla))
		return -1;

	if (!nla_adjust_settings_from_smartcard(nla))
		return -1;

	if (!nla_client_setup_identity(nla))
		return -1;

	tls = transport_get_tls(nla->transport);

	if (!tls)
	{
		WLog_ERR(TAG, "Unknown NLA transport layer");
		return -1;
	}

	if (!nla_sec_buffer_alloc_from_data(&nla->PublicKey, tls->PublicKey, 0, tls->PublicKeyLength))
	{
		WLog_ERR(TAG, "Failed to allocate sspi secBuffer");
		return -1;
	}

	length = sizeof(TERMSRV_SPN_PREFIX) + strlen(settings->ServerHostname);
	spn = (SEC_CHAR*)malloc(length + 1);

	if (!spn)
		return -1;

	sprintf_s(spn, length + 1, "%s%s", TERMSRV_SPN_PREFIX, settings->ServerHostname);
#ifdef UNICODE
	nla->ServicePrincipalName = NULL;
	ConvertToUnicode(CP_UTF8, 0, spn, -1, &nla->ServicePrincipalName, 0);
	free(spn);
#else
	nla->ServicePrincipalName = spn;
#endif

	if (!nla_sspi_module_init(nla))
		return -1;

	nla->status = nla_update_package_name(nla);
	if (nla->status != SEC_E_OK)
		return -1;

	WLog_DBG(TAG, "%s %" PRIu32 " : packageName=%s ; cbMaxToken=%" PRIu32, __FUNCTION__, __LINE__,
	         nla->packageName, nla->cbMaxToken);
	nla->status = nla->table->AcquireCredentialsHandle(NULL, NLA_PKG_NAME, SECPKG_CRED_OUTBOUND,
	                                                   NULL, nla->identity, NULL, NULL,
	                                                   &nla->credentials, &nla->expiration);

	if (nla->status != SEC_E_OK)
	{
		WLog_ERR(TAG, "AcquireCredentialsHandle status %s [0x%08" PRIX32 "]",
		         GetSecurityStatusString(nla->status), nla->status);
		return -1;
	}

	if (!nla_client_init_cred_handle(nla))
		return -1;

	nla->haveContext = FALSE;
	nla->haveInputBuffer = FALSE;
	nla->havePubKeyAuth = FALSE;

	ZeroMemory(&nla->ContextSizes, sizeof(SecPkgContext_Sizes));
	 
	nla->fContextReq = ISC_REQ_MUTUAL_AUTH | ISC_REQ_CONFIDENTIALITY;
	return 1;
}