Pass client flag to KDB for client preauth match

In the kdcpreauth match_client() callback, if it is necessary to look
up the given principal in the KDB, pass KRB5_KDB_FLAG_CLIENT to
krb5_db_get_principal().  Samba requires this flag to properly handle
enterprise client principals.

ticket: 9048 (new)

diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index e1323907e339be41ea160c91b048e6639c24f9a7..5d3dfd86c3253ea4a55e3e3304d73038581e2536 100644 (file)
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -491,7 +491,7 @@ match_client(krb5_context context, krb5_kdcpreauth_rock rock,
         krb5_principal_compare(context, princ, client))
         return TRUE;
 
-    if (krb5_db_get_principal(context, princ, 0, &ent))
+    if (krb5_db_get_principal(context, princ, KRB5_KDB_FLAG_CLIENT, &ent))
         return FALSE;
     match = krb5_principal_compare(context, ent->princ, client);
     krb5_db_free_principal(context, ent);