s4:auth: Fix 'no delegation' logic in gensec_gssapi_start()

This fixes samba4.ntvfs.cifs.krb5.base.lock test with MIT Kerberos.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15912

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Reviewed-by: Alexander Bokovoy <ab@samba.org>
(cherry picked from commit 66d3e5e49d34b0a4bfb8f2c862d48d11e27b2ea2)

Autobuild-User(v4-23-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-23-test): Fri Sep 12 07:23:04 UTC 2025 on atb-devel-224

diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c
index c43dc66ab4a58160c84cf2dc09b8a46b03630caf..6eef0547e1dedbcfb349c103c69d1fac52fd2ce6 100644 (file)
--- a/source4/auth/gensec/gensec_gssapi.c
+++ b/source4/auth/gensec/gensec_gssapi.c
@@ -200,7 +200,7 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security)
        if (gensec_setting_bool(gensec_security->settings, "gensec_gssapi", "sequence", true)) {
                gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG;
        }
-       if (!(gensec_security->want_features & GENSEC_FEATURE_NO_DELEGATION)) {
+       if (gensec_security->want_features & GENSEC_FEATURE_NO_DELEGATION) {
                gensec_gssapi_state->gss_want_flags &= ~GSS_C_DELEG_FLAG;
                gensec_gssapi_state->gss_want_flags &= ~GSS_C_DELEG_POLICY_FLAG;
        }