s3:winbindd: use GENSEC_FEATURE_NO_DELEGATION for trust credentials for netlogon

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 2a2eb3da72b02a07df001875dc34d14d71c156c7..a967abae18129dc704fbe260ccf0385358debe76 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -655,6 +655,12 @@ NTSTATUS winbindd_get_trust_credentials(struct winbindd_domain *domain,
                goto ipc_fallback;
        }
 
+       if (netlogon) {
+               cli_credentials_add_gensec_features(creds,
+                                                   GENSEC_FEATURE_NO_DELEGATION,
+                                                   CRED_SPECIFIED);
+       }
+
        if (creds_domain != domain) {
                /*
                 * We can only use schannel against a direct trust