s4:kdc: Also cannoicalize krbtgt principals when enforcing canonicalization

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 8d17038cfe660ed432b221b10dbe64dd8691a81d..77c0c0e47468dc9c7ccced0dfcaa6bdb14ddb2d1 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -946,7 +946,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
        if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
                p->is_krbtgt = true;
 
-               if (flags & (SDB_F_CANON)) {
+               if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
                        /*
                         * When requested to do so, ensure that the
                         * both realm values in the principal are set