s4:auth/credentials: S4U2Self should force CRED_MUST_USE_KERBEROS

Otherwise we would not impersonate the desired principal.
This still doesn't work for plaintext auth, but should
avoid ntlmssp.

metze

diff --git a/source4/auth/credentials/credentials_krb5.c b/source4/auth/credentials/credentials_krb5.c
index 5883282c2501f9a8b1284a45648852f33ed0b9f5..bfba1679f74671e043d6007dc4854b5f7b1fd9be 100644 (file)
--- a/source4/auth/credentials/credentials_krb5.c
+++ b/source4/auth/credentials/credentials_krb5.c
@@ -813,6 +813,7 @@ _PUBLIC_ void cli_credentials_set_impersonate_principal(struct cli_credentials *
        cred->impersonate_principal = talloc_strdup(cred, principal);
        talloc_free(cred->self_service);
        cred->self_service = talloc_strdup(cred, self_service);
+       cli_credentials_set_kerberos_state(cred, CRED_MUST_USE_KERBEROS);
 }
 
 /*