]> git.ipfire.org Git - thirdparty/samba.git/commit
s3:libads: Make sure that REALM is always added to keytab principals
authorPavel Filipenský <pfilipensky@samba.org>
Fri, 7 Mar 2025 09:32:40 +0000 (10:32 +0100)
committerPavel Filipensky <pfilipensky@samba.org>
Sun, 9 Mar 2025 00:25:08 +0000 (00:25 +0000)
commitc72554260c950d0ef7652955a59f0f68a026f4f2
tree0c69fcaf7f749ede80d0a97b7aa380e710d14b6f
parentcf34645050df64d6b8c4fa45394c3feebe691e79
s3:libads: Make sure that REALM is always added to keytab principals

The code responsible for adding SPNs to keytab should always set the
REALM part.  Current code is not adding it for e.g. SPNs synced from AD.

If REALM is missing, krb5_parse_name() will succeed (and add the REALM)
only if the krb5.conf contains libdefaults section with
default_realm set and will fail otherwise. E.g.:

[libdefaults]
default_realm = SOMETESTDOMAIN1.MY.COM

When calling 'net ads join' we get the following error if SPN is missing
REALM and krb5.conf does not provide the default_realm:

pw2kt_process_add_info: Failed to parse principal:
RestrictedKrbHost/$MACHINE_NAME
Failed to join domain: failed to create kerberos keytab

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15727

Pair-Programmed-With: Noel Power <noel.power@suse.com>

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Pavel Filipensky <pfilipensky@samba.org>
Autobuild-Date(master): Sun Mar  9 00:25:08 UTC 2025 on atb-devel-224
source3/libads/kerberos_keytab.c