From ba39080cbe3443ff08d231e30a99bb754f83edc2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 22 Feb 2017 20:07:25 +0100 Subject: [PATCH] s3:winbindd: rely on the kerberos_state from pdb_get_trust_credentials() The implementation of pdb_get_trust_credentials() should have all the details to set the kerberos_state to a useful value. This should enable the fallback to NTLMSSP again, when using our machine account against trusted domains. BUG: https://bugzilla.samba.org/show_bug.cgi?id=12598 Signed-off-by: Stefan Metzmacher Reviewed-by: Ralph Boehme (cherry picked from commit 51caeb7c538b7546e5feccf27a735bb803c78a0b) --- source3/winbindd/winbindd_cm.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c index f8e4607a845..b83b5c97ac6 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -936,17 +936,6 @@ static NTSTATUS get_trust_credentials(struct winbindd_domain *domain, goto ipc_fallback; } - if (domain->primary && lp_security() == SEC_ADS) { - cli_credentials_set_kerberos_state(creds, - CRED_AUTO_USE_KERBEROS); - } else if (domain->active_directory) { - cli_credentials_set_kerberos_state(creds, - CRED_MUST_USE_KERBEROS); - } else { - cli_credentials_set_kerberos_state(creds, - CRED_DONT_USE_KERBEROS); - } - if (creds_domain != domain) { /* * We can only use schannel against a direct trust -- 2.47.2