db-glue.c: set forwardable flag on cross-realm tgt tickets

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233

Match Windows behavior and allow the forwardable flag to be
set in cross-realm tickets. We used to allow forwardable to
any server, but now that we apply disallow-forwardable policy
in heimdal we need to explicitly allow in the corss-realm case
(and remove the workaround we have for it the MIT plugin).

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Fri Jun 12 22:10:34 UTC 2020 on sn-devel-184

diff --git a/selftest/knownfail.d/s4u2p_fwd b/selftest/knownfail.d/s4u2p_fwd
deleted file mode 100644 (file)
index 63ade3e..0000000
--- a/selftest/knownfail.d/s4u2p_fwd
+++ /dev/null
@@ -1,2 +0,0 @@
-^samba4.blackbox.krb5.s4u.get a ticket to impersonator for trust user
-^samba4.blackbox.krb5.s4u.test S4U2Proxy evidence ticket obtained by TGS of trust user

diff --git a/selftest/knownfail.d/xrealm b/selftest/knownfail.d/xrealm
deleted file mode 100644 (file)
index 2e09644..0000000
--- a/selftest/knownfail.d/xrealm
+++ /dev/null
@@ -1 +0,0 @@
-^samba.tests.krb5.xrealm_tests.samba.tests.krb5.xrealm_tests.XrealmKerberosTests.test_xrealm

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 023ae7b580d672377ea127866d54e378b9b36508..27728dab904a2bd49964ef4b3907a776eae67f97 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -1556,6 +1556,9 @@ static krb5_error_code samba_kdc_trust_message2entry(krb5_context context,
 
        entry_ex->entry.max_renew = NULL;
 
+       /* Match Windows behavior and allow forwardable flag in cross-realm. */
+       entry_ex->entry.flags.forwardable = 1;
+
        ret = samba_kdc_sort_encryption_keys(entry_ex);
        if (ret != 0) {
                krb5_clear_error_message(context);

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index 5a4f6e73e97cb914c1074bfd5e24b9146f9b92c3..54dcd545ea12df70a0a257ae7c3e6719879e86cb 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -304,11 +304,6 @@ fetch_referral_principal:
 
        sdb_free_entry(&sentry);
 
-       if ((kflags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) == 0) {
-               kentry->attributes &= ~KRB5_KDB_DISALLOW_FORWARDABLE;
-               kentry->attributes &= ~KRB5_KDB_DISALLOW_PROXIABLE;
-       }
-
 done:
        krb5_free_principal(ctx->context, referral_principal);
        referral_principal = NULL;