docs: Mark 'client use spnego principal' as deprecated and also a bad idea.

Bug 10888 - smbclient doesn't ignore "not_defined_in_RFC4178@please_ignore"

https://bugzilla.samba.org/show_bug.cgi?id=10888

Signed-off-by: Jeremy Allison <jra@samba.org>
Reviewed-by: Stefan (metze) Metzmacher <metze@samba.org>

diff --git a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
index 6ec1eb111658a245af75dc5ce6a1045c97b51364..792a7386f364f3dda8f5b5a4d684a61372e7f982 100644 (file)
--- a/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
+++ b/docs-xml/smbdotconf/security/clientusepsnegoprincipal.xml
@@ -14,6 +14,10 @@
     servers known only by IP address.  Kerberos relies on names, so
     ordinarily cannot function in this situation. </para>
 
+    <para>This is a VERY BAD IDEA for security reasons, and so this
+    parameter SHOULD NOT BE USED. It will be removed in a future
+    version of Samba.</para>
+
     <para>If disabled, Samba will use the name used to look up the
     server when asking the KDC for a ticket.  This avoids situations
     where a server may impersonate another, soliciting authentication
@@ -23,6 +27,9 @@
     <para>Note that Windows XP SP2 and later versions already follow
     this behaviour, and Windows Vista and later servers no longer
     supply this 'rfc4178 hint' principal on the server side.</para>
+
+    <para>This parameter is deprecated in Samba 4.2.1 and will be removed
+    (along with the functionality) in a later release of Samba.</para>
 </description>
 <value type="default">no</value>
 </samba:parameter>

diff --git a/lib/param/param_table.c b/lib/param/param_table.c
index d78b4d1f6642cc9f5eaad4260f05fdc171cbde36..8b44733dbed413c1eaaf729b4c56430fe602c2c3 100644 (file)
--- a/lib/param/param_table.c
+++ b/lib/param/param_table.c
@@ -765,7 +765,7 @@ struct parm_struct parm_table[] = {
                .offset         = GLOBAL_VAR(client_use_spnego_principal),
                .special        = NULL,
                .enum_list      = NULL,
-               .flags          = FLAG_ADVANCED,
+               .flags          = FLAG_ADVANCED | FLAG_DEPRECATED,
        },
        {
                .label          = "username",