From d4359c66c78a2c59e6bf3b905c4de58e920c7349 Mon Sep 17 00:00:00 2001 From: Greg Hudson Date: Tue, 18 Jan 2022 17:06:46 -0500 Subject: Pass client flag to KDB for client preauth match In the kdcpreauth match_client() callback, if it is necessary to look up the given principal in the KDB, pass KRB5_KDB_FLAG_CLIENT to krb5_db_get_principal(). Samba requires this flag to properly handle enterprise client principals. ticket: 9048 (new) --- src/kdc/kdc_preauth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c index e132390..5d3dfd8 100644 --- a/src/kdc/kdc_preauth.c +++ b/src/kdc/kdc_preauth.c @@ -491,7 +491,7 @@ match_client(krb5_context context, krb5_kdcpreauth_rock rock, krb5_principal_compare(context, princ, client)) return TRUE; - if (krb5_db_get_principal(context, princ, 0, &ent)) + if (krb5_db_get_principal(context, princ, KRB5_KDB_FLAG_CLIENT, &ent)) return FALSE; match = krb5_principal_compare(context, ent->princ, client); krb5_db_free_principal(context, ent); -- cgit v1.1