]> git.ipfire.org Git - thirdparty/samba.git/commit
s3:libads: Make sure that REALM is always added to keytab principals
authorPavel Filipenský <pfilipensky@samba.org>
Fri, 7 Mar 2025 09:32:40 +0000 (10:32 +0100)
committerJule Anger <janger@samba.org>
Thu, 13 Mar 2025 15:31:09 +0000 (15:31 +0000)
commit92253a4708b0b0b529df9aa1c97242babce2165c
treea203b68d75c9c07f0e21522e1a2d456c27b4a555
parentc0e3cabdb70fe8950813dc083b159cbe72571996
s3:libads: Make sure that REALM is always added to keytab principals

The code responsible for adding SPNs to keytab should always set the
REALM part.  Current code is not adding it for e.g. SPNs synced from AD.

If REALM is missing, krb5_parse_name() will succeed (and add the REALM)
only if the krb5.conf contains libdefaults section with
default_realm set and will fail otherwise. E.g.:

[libdefaults]
default_realm = SOMETESTDOMAIN1.MY.COM

When calling 'net ads join' we get the following error if SPN is missing
REALM and krb5.conf does not provide the default_realm:

pw2kt_process_add_info: Failed to parse principal:
RestrictedKrbHost/$MACHINE_NAME
Failed to join domain: failed to create kerberos keytab

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Pair-Programmed-With: Noel Power <noel.power@suse.com>

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sun Mar  9 00:25:08 UTC 2025 on atb-devel-224

(cherry picked from commit c72554260c950d0ef7652955a59f0f68a026f4f2)
source3/libads/kerberos_keytab.c