s4:kdc: Also cannoicalize krbtgt principals when enforcing canonicalization

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from commit f1ec950aeb47283a504018bafa21f54c3282e70c)

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index ac47fe783739def2ea5a51e3d1660b4b01c19589..d017741e30a695731a8e543d98339dbc75b12caa 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -920,7 +920,7 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
        if (ent_type == SAMBA_KDC_ENT_TYPE_KRBTGT) {
                p->is_krbtgt = true;
 
-               if (flags & (SDB_F_CANON)) {
+               if (flags & (SDB_F_CANON|SDB_F_FORCE_CANON)) {
                        /*
                         * When requested to do so, ensure that the
                         * both realm values in the principal are set