heimdal: apply disallow-forwardable on server in TGS request

upstream commit: 839b073facd2aecda6740224d73e560bc79965dc

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14233

Signed-off-by: Isaac Boukris <iboukris@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail.d/disallowed_forwardable_server b/selftest/knownfail.d/disallowed_forwardable_server
deleted file mode 100644 (file)
index 2e05909..0000000
--- a/selftest/knownfail.d/disallowed_forwardable_server
+++ /dev/null
@@ -1 +0,0 @@
-^samba4.blackbox.krb5.s4u.test S4U2Proxy using received ticket

diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
index 53d0eaf935babce155989b8442cb100a21c87062..b76726cdd64de6ec52c087f71d1493bc703f91a0 100644 (file)
--- a/source4/heimdal/kdc/krb5tgs.c
+++ b/source4/heimdal/kdc/krb5tgs.c
@@ -866,6 +866,12 @@ tgs_make_reply(krb5_context context,
     et.flags.anonymous   = tgt->flags.anonymous;
     et.flags.ok_as_delegate = server->entry.flags.ok_as_delegate;
 
+    /* See MS-KILE 3.3.5.1 */
+    if (!server->entry.flags.forwardable)
+        et.flags.forwardable = 0;
+    if (!server->entry.flags.proxiable)
+        et.flags.proxiable = 0;
+
     if(rspac->length) {
        /*
         * No not need to filter out the any PAC from the