From: Joseph Sutton Date: Tue, 23 Nov 2021 07:15:41 +0000 (+1300) Subject: kdc: Always add the PAC if the header TGT is from an RODC X-Git-Tag: tdb-1.4.6~537 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=690a00a40c0a3f77da6e4dca42b630f2793a98b8;p=thirdparty%2Fsamba.git kdc: Always add the PAC if the header TGT is from an RODC Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index d89d69deed2..3b78491c837 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -128,5 +128,4 @@ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate -^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c index ecd182702c3..8c3ce71529c 100644 --- a/source4/kdc/wdc-samba4.c +++ b/source4/kdc/wdc-samba4.c @@ -471,7 +471,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, goto out; } - if (!server_skdc_entry->is_krbtgt) { + if (!is_untrusted && !server_skdc_entry->is_krbtgt) { /* * The client may have requested no PAC when obtaining the * TGT.