auth/credentials_krb5: make use of smb_gss_krb5_prepare_acceptor_cred()

We should check all keys in our in memory keytab
and skip the transited checks unless we're
in standalone/MIT-realm mode.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12907
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14125

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/auth/credentials/credentials_krb5.c b/auth/credentials/credentials_krb5.c
index cd40b48093d4b80b17cab47f545d5302a4c1a921..7ff36a25059480bcfdfab09eba3ffa11954cbe96 100644 (file)
--- a/auth/credentials/credentials_krb5.c
+++ b/auth/credentials/credentials_krb5.c
@@ -34,6 +34,7 @@
 #include "auth/kerberos/pac_utils.h"
 #include "param/param.h"
 #include "../libds/common/flags.h"
+#include "../libds/common/roles.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
@@ -1309,6 +1310,12 @@ _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
        krb5_principal princ;
        const char *error_string;
        enum credentials_obtained obtained;
+       enum server_role server_role = lpcfg_server_role(lp_ctx);
+       /*
+        * We require a PAC and can skip the transited check
+        * (unless we're in standalone/MIT-realm mode)
+        */
+       bool skip_transited_check = (server_role != ROLE_STANDALONE);
 
        mem_ctx = talloc_new(cred);
        if (!mem_ctx) {
@@ -1369,6 +1376,20 @@ _PUBLIC_ int cli_credentials_get_server_gss_creds(struct cli_credentials *cred,
                talloc_free(mem_ctx);
                return ret;
        }
+       maj_stat = smb_gss_krb5_prepare_acceptor_cred(&min_stat,
+                                                     skip_transited_check,
+                                                     &gcc->creds);
+       if (maj_stat) {
+               if (min_stat) {
+                       ret = min_stat;
+               } else {
+                       ret = EINVAL;
+               }
+       }
+       if (ret != 0) {
+               talloc_free(mem_ctx);
+               return ret;
+       }
        cred->server_gss_creds_obtained = cred->keytab_obtained;
        talloc_set_destructor(gcc, free_gssapi_creds);
        cred->server_gss_creds = gcc;