s4:auth: Fix 'no delegation' logic in gensec_gssapi_start()

This fixes samba4.ntvfs.cifs.krb5.base.lock test with MIT Kerberos.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15912

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Alexander Bokovoy <ab@samba.org>

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index 346406bf13b92c56a118562bb10c36ddcbbbdfc2..02cf7961ee4be8d52426326fbab488a754796c84 100644 (file)
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -200,7 +200,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
        if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "sequence", true)) {
                gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG;
        }
-       if (!(gensec_security->want_features & GENSEC_FEATURE_NO_DELEGATION)) {
+       if (gensec_security->want_features & GENSEC_FEATURE_NO_DELEGATION) {
                gensec_gssapi_state->gss_want_flags &= ~GSS_C_DELEG_FLAG;
                gensec_gssapi_state->gss_want_flags &= ~GSS_C_DELEG_POLICY_FLAG;
        }