s4:kdc: Fix S4U2Proxy in RODC case to return an error

Tested also against Windows Server 2022.

Details:
https://lists.samba.org/archive/cifs-protocol/2022-April/003673.html

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andreas Schneider <asn@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index 73c72451ba5acaa2df06d3d29cb506d0c5b4bc34..4ae27eacb0919b6ffcc402ed199fc622b40e559c 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -44,7 +44,6 @@
 #
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_renew_rodc_not_revealed
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_not_revealed
-^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_s4u2self_rodc_revealed
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_not_revealed
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_user2user_rodc_not_revealed
 ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_not_revealed

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index fcc17baad0f3fa5ca03a4c40f4d11d8283283a04..5db40375e7f8873911b73450d23b37cb2518a9ee 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -1522,6 +1522,22 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
                        }
                        goto done;
                }
+
+               /*
+                * The RODC PAC data isn't trusted for authorization as it may
+                * be stale. The only thing meaningful we can do with an RODC
+                * account on a full DC is exchange the RODC TGT for a 'real'
+                * TGT.
+                *
+                * So we match Windows (at least server 2022) and
+                * don't allow S4U2Self.
+                *
+                * https://lists.samba.org/archive/cifs-protocol/2022-April/003673.html
+                */
+               if (flags & SAMBA_KDC_FLAG_PROTOCOL_TRANSITION) {
+                       code = KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN;
+                       goto done;
+               }
        } else {
                pac_blob = talloc_zero(mem_ctx, DATA_BLOB);
                if (pac_blob == NULL) {