s4:kdc: don't log an error if msDS-AllowedToActOnBehalfOfOtherIdentity is missing

We log a warnings if access is not granted from a security descriptor in
msDS-AllowedToActOnBehalfOfOtherIdentity, so we should use the same log
level if msDS-AllowedToActOnBehalfOfOtherIdentity is not available at
all.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jun 27 06:39:08 UTC 2023 on atb-devel-224

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index c07c2dbc24a83b14be03d45da31e2d58e195e094..5894b47ecd9ed2bfb5deb1e7447c6518afb58c8d 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -3449,10 +3449,10 @@ krb5_error_code samba_kdc_check_s4u2proxy_rbcd(
        data = ldb_msg_find_ldb_val(proxy_skdc_entry->msg,
                                    "msDS-AllowedToActOnBehalfOfOtherIdentity");
        if (data == NULL) {
-               DBG_ERR("Could not find security descriptor "
-                       "msDS-AllowedToActOnBehalfOfOtherIdentity in "
-                       "proxy[%s]\n",
-                       proxy_dn);
+               DBG_WARNING("Could not find security descriptor "
+                           "msDS-AllowedToActOnBehalfOfOtherIdentity in "
+                           "proxy[%s]\n",
+                           proxy_dn);
                code = KRB5KDC_ERR_BADOPTION;
                goto out;
        }