From: Noel Power <noel.power@suse.com>
Date: Mon, 29 Jan 2018 18:38:05 +0000 (+0000)
Subject: s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 2
X-Git-Tag: talloc-2.1.12~292
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6cac9a4720713592ba9d0a88c39e331ec42baef4;p=thirdparty%2Fsamba.git

s3:libads: Allow 'net ads keytab add' handle Windows SPN(s) part 2

This patch addresses how the windows SPN is written to the AD.

If a legacy service (e.g. cifs, http etc.) is passed as param to
'net ads keytab add param' then windows SPNs are generated from
'param' as follows
          i) long form 'param/full_qualified_dns'
         ii) short form 'param/netbios_name'

If the SPN is a is a Windows SPN (e.g. conforming to format
'serviceclass/host:port') then this is the SPN that is passed to
the AD.

Signed-off-by: Noel Power <noel.power@suse.com>
Reviewed-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
---

diff --git a/source3/libads/kerberos_keytab.c b/source3/libads/kerberos_keytab.c
index bcfeadc880a..b23baae8ae0 100644
--- a/source3/libads/kerberos_keytab.c
+++ b/source3/libads/kerberos_keytab.c
@@ -135,19 +135,35 @@ static bool ads_set_machine_account_spns(TALLOC_CTX *ctx,
 {
 	const char **spn_names = NULL;
 	ADS_STATUS aderr;
-	bool ok = false;
+	struct spn_struct* spn_struct = NULL;
+	char *tmp = NULL;
+
+	/* SPN should have '/' */
+	tmp = strchr_m(service_or_spn, '/');
+	if (tmp != NULL) {
+		spn_struct = parse_spn(ctx, service_or_spn);
+		if (spn_struct == NULL) {
+			return false;
+		}
+	}
 
 	DBG_INFO("Attempting to add/update '%s'\n", service_or_spn);
 
-	ok = fill_default_spns(ctx,
-			       lp_netbios_name(),
-			       my_fqdn,
-			       service_or_spn,
-			       &spn_names);
-	if (!ok) {
-		return false;
+	if (spn_struct != NULL) {
+		spn_names = talloc_zero_array(ctx, const char*, 2);
+		spn_names[0] = service_or_spn;
+	} else {
+		bool ok;
+
+		ok = fill_default_spns(ctx,
+				       lp_netbios_name(),
+				       my_fqdn,
+				       service_or_spn,
+				       &spn_names);
+		if (!ok) {
+			return false;
+		}
 	}
-
 	aderr = ads_add_service_principal_names(ads,
 						lp_netbios_name(),
 						spn_names);