Revert "s4/heimdal: allow SPNs in AS-REQ"

This reverts commit 20dc68050df7b1b0c9d06f8251183a0a6283fcaf.

Tests (the krb5.kdc testsuite) show this behaviour is incorrect.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/selftest/knownfail.d/kdc b/selftest/knownfail.d/kdc
deleted file mode 100644 (file)
index 38f0615..0000000
--- a/selftest/knownfail.d/kdc
+++ /dev/null
@@ -1,320 +0,0 @@
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self

diff --git a/selftest/knownfail.d/keytab b/selftest/knownfail.d/keytab
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..c835fb39eae7d64b651c67b6a25188547f2f6e4b 100644 (file)
--- a/selftest/knownfail.d/keytab
+++ b/selftest/knownfail.d/keytab
@@ -0,0 +1 @@
+^samba4.blackbox.export.keytab.*.kinit with SPN from keytab
\ No newline at end of file

diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c
index 12187dde4299de7c8ce5b7f3bafae39ee557354d..a3ba5fef0ee44ea52730cd49d48bd90fca4b1a02 100644 (file)
--- a/source4/heimdal/kdc/kerberos5.c
+++ b/source4/heimdal/kdc/kerberos5.c
@@ -762,9 +762,9 @@ kdc_check_flags(krb5_context context,
            return KRB5KDC_ERR_POLICY;
        }
 
-       if (!is_as_req && !client->flags.client){
+       if(!client->flags.client){
            kdc_log(context, config, 0,
-                   "Principal may only act as client in AS-REQ -- %s", client_name);
+                   "Principal may not act as client -- %s", client_name);
            return KRB5KDC_ERR_POLICY;
        }
 
@@ -1056,7 +1056,7 @@ _kdc_as_rep(krb5_context context,
      */
 
     ret = _kdc_db_fetch(context, config, client_princ,
-                       HDB_F_GET_ANY | flags, NULL,
+                       HDB_F_GET_CLIENT | flags, NULL,
                        &clientdb, &client);
     if(ret == HDB_ERR_NOT_FOUND_HERE) {
        kdc_log(context, config, 5, "client %s does not have secrets at this KDC, need to proxy", client_name);