mit_samba: Allow to use SPNs for AS-REQ

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Thu Jun  2 16:35:35 CEST 2016 on sn-devel-144

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c
index bfcbbc3e06876ebcad13ef79f9b326c53955e165..69cddac37e768b841560402e1cfeb74e47d9082b 100644 (file)
--- a/source4/kdc/mit_samba.c
+++ b/source4/kdc/mit_samba.c
@@ -199,8 +199,11 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,
                /*
                 * KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY is equal to
                 * SDB_F_FOR_AS_REQ
+                *
+                * We use ANY to also allow AS_REQ for service principal names
+                * This is supported by Windows.
                 */
-               sflags |= SDB_F_GET_CLIENT|SDB_F_FOR_AS_REQ;
+               sflags |= SDB_F_GET_ANY|SDB_F_FOR_AS_REQ;
        } else if (ks_is_tgs_principal(ctx, principal)) {
                sflags |= SDB_F_GET_KRBTGT;
        } else {