From: Joseph Sutton Date: Tue, 23 Nov 2021 07:15:41 +0000 (+1300) Subject: kdc: Always add the PAC if the header TGT is from an RODC X-Git-Tag: samba-4.14.14~60 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=93a5264dd68da57e172af50020f670631eeef263;p=thirdparty%2Fsamba.git kdc: Always add the PAC if the header TGT is from an RODC Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett (cherry picked from commit 690a00a40c0a3f77da6e4dca42b630f2793a98b8) --- diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index 981d7894158..94a4509f45a 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -290,5 +290,4 @@ ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_missing_validate ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_renew ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_requester_sid_rodc_validate -^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_tgs_rodc_pac_request_false ^samba.tests.krb5.kdc_tgs_tests.samba.tests.krb5.kdc_tgs_tests.KdcTgsTests.test_validate_rodc_revealed diff --git a/source4/kdc/wdc-samba4.c b/source4/kdc/wdc-samba4.c index ecd182702c3..8c3ce71529c 100644 --- a/source4/kdc/wdc-samba4.c +++ b/source4/kdc/wdc-samba4.c @@ -471,7 +471,7 @@ static krb5_error_code samba_wdc_reget_pac2(krb5_context context, goto out; } - if (!server_skdc_entry->is_krbtgt) { + if (!is_untrusted && !server_skdc_entry->is_krbtgt) { /* * The client may have requested no PAC when obtaining the * TGT.