From: Andreas Schneider <asn@samba.org>
Date: Tue, 21 Dec 2021 11:17:11 +0000 (+0100)
Subject: s4:kdc: Also cannoicalize krbtgt principals when enforcing canonicalization
X-Git-Tag: samba-4.14.14~81
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06a0a75b16bace9c29568653d9e4bde4050c5ee5;p=thirdparty%2Fsamba.git

s4:kdc: Also cannoicalize krbtgt principals when enforcing canonicalization

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f1ec950aeb47283a504018bafa21f54c3282e70c)
---

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index ac47fe78373..d017741e30a 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -920,7 +920,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
 	if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
 		p->is_krbtgt = true;
 
-		if (flags & (SDB_F_CANON)) {
+		if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
 			/*
 			 * When requested to do so, ensure that the
 			 * both realm values in the principal are set