From: Stefan Metzmacher <metze@samba.org>
Date: Fri, 23 Jun 2023 09:51:47 +0000 (+0200)
Subject: s4:kdc: don't log an error if msDS-AllowedToActOnBehalfOfOtherIdentity is missing
X-Git-Tag: talloc-2.4.1~162
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b0524830aaf0ccf7dc2efbe66d2bf38b509c0143;p=thirdparty%2Fsamba.git

s4:kdc: don't log an error if msDS-AllowedToActOnBehalfOfOtherIdentity is missing

We log a warnings if access is not granted from a security descriptor in
msDS-AllowedToActOnBehalfOfOtherIdentity, so we should use the same log
level if msDS-AllowedToActOnBehalfOfOtherIdentity is not available at
all.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Tue Jun 27 06:39:08 UTC 2023 on atb-devel-224
---

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index c07c2dbc24a..5894b47ecd9 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -3449,10 +3449,10 @@ krb5_error_code samba_kdc_check_s4u2proxy_rbcd(
 	data = ldb_msg_find_ldb_val(proxy_skdc_entry->msg,
 				    "msDS-AllowedToActOnBehalfOfOtherIdentity");
 	if (data == NULL) {
-		DBG_ERR("Could not find security descriptor "
-			"msDS-AllowedToActOnBehalfOfOtherIdentity in "
-			"proxy[%s]\n",
-			proxy_dn);
+		DBG_WARNING("Could not find security descriptor "
+			    "msDS-AllowedToActOnBehalfOfOtherIdentity in "
+			    "proxy[%s]\n",
+			    proxy_dn);
 		code = KRB5KDC_ERR_BADOPTION;
 		goto out;
 	}