From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 4 Sep 2020 15:00:45 +0000 (+0200)
Subject: auth:gensec: If Kerberos is required, keep schannel for machine account auth
X-Git-Tag: talloc-2.3.2~640
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=515cffb1f20eacb041ff7b3d43f8a122a82ddfbd;p=thirdparty%2Fsamba.git

auth:gensec: If Kerberos is required, keep schannel for machine account auth

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@samba.org>
---

diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c
index be199358ffc..4996e13e027 100644
--- a/auth/gensec/gensec_start.c
+++ b/auth/gensec/gensec_start.c
@@ -170,6 +170,15 @@ _PUBLIC_ const struct gensec_security_ops **gensec_security_mechs(
 			if (cli_credentials_get_netlogon_creds(creds) != NULL) {
 				keep_schannel = true;
 			}
+
+			/*
+			 * Even if Kerberos is set to REQUIRED, keep the
+			 * schannel auth mechanism that machine accounts are
+			 * able to authenticate via netlogon.
+			 */
+			if (gensec_security->gensec_role == GENSEC_SERVER) {
+				keep_schannel = true;
+			}
 		}
 
 		if (gensec_security->settings->backends) {