s3:utils: Allow ROLE_IPA_DC to allow to use Kerberos in gensec

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15891

Signed-off-by: Pavel Filipenský <pfilipensky@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Tue Aug  5 14:51:51 UTC 2025 on atb-devel-224

diff --git a/source3/utils/ntlm_auth.c b/source3/utils/ntlm_auth.c
index e839076f8d52a5f5743c16879ca172dea7e679b3..d5ae7c85b223f876c1c3bed46fd87d3d91a54c80 100644 (file)
--- a/source3/utils/ntlm_auth.c
+++ b/source3/utils/ntlm_auth.c
@@ -1355,7 +1355,11 @@ static NTSTATUS ntlm_auth_prepare_gensec_server(TALLOC_CTX *mem_ctx,
 
        cli_credentials_set_conf(server_credentials, lp_ctx);
 
-       if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC || lp_security() == SEC_ADS || USE_KERBEROS_KEYTAB) {
+       if (lp_server_role() == ROLE_ACTIVE_DIRECTORY_DC ||
+           lp_server_role() == ROLE_IPA_DC ||
+           lp_security() == SEC_ADS ||
+           USE_KERBEROS_KEYTAB)
+       {
                cli_credentials_set_kerberos_state(server_credentials,
                                                   CRED_USE_KERBEROS_DESIRED,
                                                   CRED_SPECIFIED);