s4:kdc: clear client and device claims from trusts

As we don't support the Claims Transformation Algorithm [MS-CTA]
we better clear claims as they have no valid meaning in our domain.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/kdc/pac-glue.c b/source4/kdc/pac-glue.c
index 168b3a4d246651d013a9110b33db41d8e5aad3e8..bd7c3ce634d2eeb80c9408b17c7c39f5aa687fea 100644 (file)
--- a/source4/kdc/pac-glue.c
+++ b/source4/kdc/pac-glue.c
@@ -2421,6 +2421,12 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
                                /* no-op */
                        } else if (code != 0) {
                                goto done;
+                       } else if (device_krbtgt->is_trust) {
+                               /*
+                                * TODO: we need claim translation over trusts,
+                                * for now we just clear them...
+                                */
+                               device_claims_blob = &data_blob_null;
                        } else {
                                DATA_BLOB *device_claims = NULL;
 
@@ -2588,6 +2594,14 @@ krb5_error_code samba_kdc_update_pac(TALLOC_CTX *mem_ctx,
                        code = EINVAL;
                        goto done;
                }
+
+               /*
+                * TODO: we need claim translation over trusts,
+                * for now we just clear them...
+                */
+               if (client_krbtgt->is_trust) {
+                       client_claims_blob = &data_blob_null;
+               }
        } else {
                nt_status = samba_kdc_get_logon_info_blob(mem_ctx,
                                                       user_info_dc,