From 0b196043f08ea4c025f19c4519175a3a73e1d185 Mon Sep 17 00:00:00 2001

From: Isaac Boukris <iboukris@gmail.com>

Date: Fri, 27 Sep 2019 18:25:03 +0300

Subject: [PATCH 1/3] mit-kdc: add basic loacl realm S4U support

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

---

 source4/kdc/mit-kdb/kdb_samba_policies.c | 124 +++++++++++------------

 source4/kdc/mit_samba.c                  |  47 ++-------

 source4/kdc/mit_samba.h                  |   6 +-

 3 files changed, 71 insertions(+), 106 deletions(-)

diff --git a/source4/kdc/mit-kdb/kdb_samba_policies.c b/source4/kdc/mit-kdb/kdb_samba_policies.c

index f35210669c2..b1c7c5dcc5e 100644

--- a/source4/kdc/mit-kdb/kdb_samba_policies.c

+++ b/source4/kdc/mit-kdb/kdb_samba_policies.c

@@ -195,13 +195,17 @@ static krb5_error_code ks_verify_pac(krb5_context context,

 				     krb5_keyblock *krbtgt_key,

 				     krb5_timestamp authtime,

 				     krb5_authdata **tgt_auth_data,

-				     krb5_pac *pac)

+				     krb5_pac *out_pac)

 {

 	struct mit_samba_context *mit_ctx;

 	krb5_authdata **authdata = NULL;

-	krb5_pac ipac = NULL;

-	DATA_BLOB logon_data = { NULL, 0 };

+	krb5_keyblock *header_server_key = NULL;

+	krb5_key_data *impersonator_kd = NULL;

+	krb5_keyblock impersonator_key = {0};

 	krb5_error_code code;

+	krb5_pac pac;

+

+	*out_pac = NULL;

 	mit_ctx = ks_get_context(context);

 	if (mit_ctx == NULL) {

@@ -233,41 +237,43 @@ static krb5_error_code ks_verify_pac(krb5_context context,

 	code = krb5_pac_parse(context,

 			      authdata[0]->contents,

 			      authdata[0]->length,

-			      &ipac);

+			      &pac;;

 	if (code != 0) {

 		goto done;

 	}

-	/* TODO: verify this is correct

-	 *

-	 * In the constrained delegation case, the PAC is from a service

-	 * ticket rather than a TGT; we must verify the server and KDC

-	 * signatures to assert that the server did not forge the PAC.

+	/*

+	 * For constrained delegation in MIT version < 1.18 we aren't provided

+	 * with the 2nd ticket server key to verify the PAC.

+	 * We can workaround that by fetching the key from the client db entry,

+	 * which is the impersonator account in that version.

+	 * TODO: use the provided entry in the new 1.18 version.

 	 */

 	if (flags & KRB5_KDB_FLAG_CONSTRAINED_DELEGATION) {

-		code = krb5_pac_verify(context,

-				       ipac,

-				       authtime,

-				       client_princ,

-				       server_key,

-				       krbtgt_key);

+		/* The impersonator must be local. */

+		if (client == NULL) {

+			code = KRB5KDC_ERR_BADOPTION;

+			goto done;

+		}

+		/* Fetch and decrypt 2nd ticket server's current key. */

+		code = krb5_dbe_find_enctype(context, client, -1, -1, 0,

+					     &impersonator_kd);

+		if (code != 0) {

+			goto done;

+		}

+		code = krb5_dbe_decrypt_key_data(context, NULL,

+						 impersonator_kd,

+						 &impersonator_key, NULL);

+		if (code != 0) {

+			goto done;

+		}

+		header_server_key = &impersonator_key;

 	} else {

-		code = krb5_pac_verify(context,

-				       ipac,

-				       authtime,

-				       client_princ,

-				       krbtgt_key,

-				       NULL);

-	}

-	if (code != 0) {

-		goto done;

+		header_server_key = krbtgt_key;

 	}

-	/* check and update PAC */

-	code = krb5_pac_parse(context,

-			      authdata[0]->contents,

-			      authdata[0]->length,

-			      pac);

+	code = krb5_pac_verify(context, pac, authtime, client_princ,

+			       header_server_key, NULL);

 	if (code != 0) {

 		goto done;

 	}

@@ -275,17 +281,22 @@ static krb5_error_code ks_verify_pac(krb5_context context,

 	code = mit_samba_reget_pac(mit_ctx,

 				   context,

 				   flags,

-				   client_princ,

 				   client,

 				   server,

 				   krbtgt,

 				   krbtgt_key,

-				   pac);

+				   &pac;;

+	if (code != 0) {

+		goto done;

+	}

+

+	*out_pac = pac;

+	pac = NULL;

 done:

+	krb5_free_keyblock_contents(context, &impersonator_key);

 	krb5_free_authdata(context, authdata);

-	krb5_pac_free(context, ipac);

-	free(logon_data.data);

+	krb5_pac_free(context, pac);

 	return code;

 }

@@ -314,6 +325,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 	krb5_authdata **pac_auth_data = NULL;

 	krb5_authdata **authdata = NULL;

 	krb5_boolean is_as_req;

+	krb5_const_principal pac_client;

 	krb5_error_code code;

 	krb5_pac pac = NULL;

 	krb5_data pac_data;

@@ -325,11 +337,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 	krbtgt = krbtgt == NULL ? local_krbtgt : krbtgt;

 	krbtgt_key = krbtgt_key == NULL ? local_krbtgt_key : krbtgt_key;

-	/* FIXME: We don't support S4U yet */

-	if (flags & KRB5_KDB_FLAGS_S4U) {

-		return KRB5_KDB_DBTYPE_NOSUP;

-	}

-

 	is_as_req = ((flags & KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY) != 0);

 	/*

@@ -390,6 +397,16 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 		ks_client_princ = client->princ;

 	}

+	/* In protocol transition, we are currently not provided with the tgt

+	 * client name to verify the PAC, we could probably skip the name

+	 * verification and just verify the signatures, but since we don't

+	 * support cross-realm nor aliases, we can just use server->princ */

+	if (flags & KRB5_KDB_FLAG_PROTOCOL_TRANSITION) {

+		pac_client = server->princ;

+	} else {

+		pac_client = ks_client_princ;

+	}

+

 	if (client_entry == NULL) {

 		client_entry = client;

 	}

@@ -454,7 +471,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 			code = ks_verify_pac(context,

 					     flags,

-					     ks_client_princ,

+					     pac_client,

 					     client_entry,

 					     server,

 					     krbtgt,

@@ -494,7 +511,7 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 		  is_as_req ? "AS-REQ" : "TGS-REQ",

 		  client_name);

 	code = krb5_pac_sign(context, pac, authtime, ks_client_princ,

-			server_key, krbtgt_key, &pac_data);

+			     server_key, krbtgt_key, &pac_data);

 	if (code != 0) {

 		DBG_ERR("krb5_pac_sign failed: %d\n", code);

 		goto done;

@@ -520,12 +537,6 @@ krb5_error_code kdb_samba_db_sign_auth_data(krb5_context context,

 					      KRB5_AUTHDATA_IF_RELEVANT,

 					      authdata,

 					      signed_auth_data);

-	if (code != 0) {

-		goto done;

-	}

-

-	code = 0;

-

 done:

 	if (client_entry != NULL && client_entry != client) {

 		ks_free_principal(context, client_entry);

@@ -551,32 +562,13 @@ krb5_error_code kdb_samba_db_check_allowed_to_delegate(krb5_context context,

 	 * server; -> delegating service

 	 * proxy; -> target principal

 	 */

-	krb5_db_entry *delegating_service = discard_const_p(krb5_db_entry, server);

-

-	char *target_name = NULL;

-	bool is_enterprise;

-	krb5_error_code code;

 	mit_ctx = ks_get_context(context);

 	if (mit_ctx == NULL) {

 		return KRB5_KDB_DBNOTINITED;

 	}

-	code = krb5_unparse_name(context, proxy, &target_name);

-	if (code) {

-		goto done;

-	}

-

-	is_enterprise = (proxy->type == KRB5_NT_ENTERPRISE_PRINCIPAL);

-

-	code = mit_samba_check_s4u2proxy(mit_ctx,

-					 delegating_service,

-					 target_name,

-					 is_enterprise);

-

-done:

-	free(target_name);

-	return code;

+	return mit_samba_check_s4u2proxy(mit_ctx, server, proxy);

 }

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c

index 4239332f0d9..acc3cba6254 100644

--- a/source4/kdc/mit_samba.c

+++ b/source4/kdc/mit_samba.c

@@ -501,7 +501,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,

 krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,

 				    krb5_context context,

 				    int flags,

-				    krb5_const_principal client_principal,

 				    krb5_db_entry *client,

 				    krb5_db_entry *server,

 				    krb5_db_entry *krbtgt,

@@ -665,7 +664,7 @@ krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,

 								  context,

 								  *pac,

 								  server->princ,

-								  discard_const(client_principal),

+								  client->princ,

 								  deleg_blob);

 		if (!NT_STATUS_IS_OK(nt_status)) {

 			DEBUG(0, ("Update delegation info failed: %s\n",

@@ -987,41 +986,17 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,

 }

 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,

-			      krb5_db_entry *kentry,

-			      const char *target_name,

-			      bool is_nt_enterprise_name)

+			      const krb5_db_entry *server,

+			      krb5_const_principal target_principal)

 {

-#if 1

-	/*

-	 * This is disabled because mit_samba_update_pac_data() does not handle

-	 * S4U_DELEGATION_INFO

-	 */

-

-	return KRB5KDC_ERR_BADOPTION;

-#else

-	krb5_principal target_principal;

-	int flags = 0;

-	int ret;

-

-	if (is_nt_enterprise_name) {

-		flags = KRB5_PRINCIPAL_PARSE_ENTERPRISE;

-	}

-

-	ret = krb5_parse_name_flags(ctx->context, target_name,

-				    flags, &target_principal);

-	if (ret) {

-		return ret;

-	}

-

-	ret = samba_kdc_check_s4u2proxy(ctx->context,

-					ctx->db_ctx,

-					skdc_entry,

-					target_principal);

-

-	krb5_free_principal(ctx->context, target_principal);

-

-	return ret;

-#endif

+	struct samba_kdc_entry *server_skdc_entry =

+		 talloc_get_type_abort(server->e_data,

+				       struct samba_kdc_entry);

+

+	return samba_kdc_check_s4u2proxy(ctx->context,

+					 ctx->db_ctx,

+					 server_skdc_entry,

+					 target_principal);

 }

 static krb5_error_code mit_samba_change_pwd_error(krb5_context context,

diff --git a/source4/kdc/mit_samba.h b/source4/kdc/mit_samba.h

index 636c77ec97c..9cb00c9610e 100644

--- a/source4/kdc/mit_samba.h

+++ b/source4/kdc/mit_samba.h

@@ -56,7 +56,6 @@ int mit_samba_get_pac(struct mit_samba_context *smb_ctx,

 krb5_error_code mit_samba_reget_pac(struct mit_samba_context *ctx,

 				    krb5_context context,

 				    int flags,

-				    krb5_const_principal client_principal,

 				    krb5_db_entry *client,

 				    krb5_db_entry *server,

 				    krb5_db_entry *krbtgt,

@@ -73,9 +72,8 @@ int mit_samba_check_client_access(struct mit_samba_context *ctx,

 				  DATA_BLOB *e_data);

 int mit_samba_check_s4u2proxy(struct mit_samba_context *ctx,

-			      krb5_db_entry *kentry,

-			      const char *target_name,

-			      bool is_nt_enterprise_name);

+			      const krb5_db_entry *server,

+			      krb5_const_principal target_principal);

 int mit_samba_kpasswd_change_password(struct mit_samba_context *ctx,

 				      char *pwd,

-- 

2.33.1

From 992d38fa35c01f2f0bdb39d387fa29e8eb8d3d37 Mon Sep 17 00:00:00 2001

From: Isaac Boukris <iboukris@gmail.com>

Date: Fri, 27 Sep 2019 18:35:30 +0300

Subject: [PATCH 2/3] krb5-mit: enable S4U client support for MIT build

Signed-off-by: Isaac Boukris <iboukris@gmail.com>

Pair-Programmed-With: Andreas Schneider <asn@samba.org>

---

 lib/krb5_wrap/krb5_samba.c            | 185 ++++++++++++++++++++++++++

 lib/krb5_wrap/krb5_samba.h            |   2 -

 source4/auth/kerberos/kerberos_util.c |  11 --

 3 files changed, 185 insertions(+), 13 deletions(-)

diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c

index fff5b4e2a22..791b417d5ba 100644

--- a/lib/krb5_wrap/krb5_samba.c

+++ b/lib/krb5_wrap/krb5_samba.c

@@ -2694,6 +2694,191 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,

 	return 0;

 }

+

+#else /* MIT */

+

+static bool princ_compare_no_dollar(krb5_context ctx,

+				    krb5_principal a,

+				    krb5_principal b)

+{

+	bool cmp;

+	krb5_principal mod = NULL;

+

+	if (a->length == 1 && b->length == 1 &&

+	    a->data[0].length != 0 && b->data[0].length != 0 &&

+	    a->data[0].data[a->data[0].length -1] !=

+	    b->data[0].data[b->data[0].length -1]) {

+		if (a->data[0].data[a->data[0].length -1] == '$') {

+			mod = a;

+			mod->data[0].length--;

+		} else if (b->data[0].data[b->data[0].length -1] == '$') {

+			mod = b;

+			mod->data[0].length--;

+		}

+	}

+

+	cmp = krb5_principal_compare_flags(ctx, a, b,

+					   KRB5_PRINCIPAL_COMPARE_CASEFOLD);

+

+	if (mod != NULL) {

+		mod->data[0].length++;

+	}

+

+	return cmp;

+}

+

+krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,

+					   krb5_ccache store_cc,

+					   krb5_principal init_principal,

+					   const char *init_password,

+					   krb5_principal impersonate_principal,

+					   const char *self_service,

+					   const char *target_service,

+					   krb5_get_init_creds_opt *krb_options,

+					   time_t *expire_time,

+					   time_t *kdc_time)

+{

+	krb5_error_code code;

+	krb5_principal self_princ = NULL;

+	krb5_principal target_princ = NULL;

+	krb5_creds *store_creds;

+	krb5_creds *s4u2self_creds = NULL;

+	krb5_creds *s4u2proxy_creds = NULL;

+	krb5_creds init_creds = {0};

+	krb5_creds mcreds = {0};

+	krb5_flags options = KRB5_GC_NO_STORE;

+	krb5_ccache tmp_cc;

+	bool s4u2proxy;

+

+	code = krb5_cc_new_unique(ctx, "MEMORY", NULL, &tmp_cc);

+	if (code != 0) {

+		return code;

+	}

+

+	code = krb5_get_init_creds_password(ctx, &init_creds,

+					    init_principal,

+					    init_password,

+					    NULL, NULL,

+					    0,

+					    NULL,

+					    krb_options);

+	if (code != 0) {

+		goto done;

+	}

+

+	code = krb5_cc_initialize(ctx, tmp_cc, init_creds.client);

+	if (code != 0) {

+		goto done;

+	}

+

+	code = krb5_cc_store_cred(ctx, tmp_cc, &init_creds);

+	if (code != 0) {

+		goto done;

+	}

+

+	/*

+	 * Check if we also need S4U2Proxy or if S4U2Self is

+	 * enough in order to get a ticket for the target.

+	 */

+	if (target_service == NULL) {

+		s4u2proxy = false;

+	} else if (strcmp(target_service, self_service) == 0) {

+		s4u2proxy = false;

+	} else {

+		s4u2proxy = true;

+	}

+

+	code = krb5_parse_name(ctx, self_service, &self_princ);

+	if (code != 0) {

+		goto done;

+	}

+

+	/* MIT lacks aliases support in S4U, for S4U2Self we require the tgt

+	 * client and the request server to be the same principal name. */

+	if (!princ_compare_no_dollar(ctx, init_creds.client, self_princ)) {

+		code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;

+		goto done;

+	}

+

+	mcreds.client = impersonate_principal;

+	mcreds.server = init_creds.client;

+

+	code = krb5_get_credentials_for_user(ctx, options, tmp_cc, &mcreds,

+					     NULL, &s4u2self_creds);

+	if (code != 0) {

+		goto done;

+	}

+

+	if (s4u2proxy) {

+		code = krb5_parse_name(ctx, target_service, &target_princ);

+		if (code != 0) {

+			goto done;

+		}

+

+		mcreds.client = init_creds.client;

+		mcreds.server = target_princ;

+		mcreds.second_ticket = s4u2self_creds->ticket;

+

+		code = krb5_get_credentials(ctx, options |

+					    KRB5_GC_CONSTRAINED_DELEGATION,

+					    tmp_cc, &mcreds, &s4u2proxy_creds);

+		if (code != 0) {

+			goto done;

+		}

+

+		/* Check KDC support of S4U2Proxy extension */

+		if (!krb5_principal_compare(ctx, s4u2self_creds->client,

+					    s4u2proxy_creds->client)) {

+			code = KRB5KDC_ERR_PADATA_TYPE_NOSUPP;

+			goto done;

+		}

+

+		store_creds = s4u2proxy_creds;

+	} else {

+		store_creds = s4u2self_creds;;

+

+		/* We need to save the ticket with the requested server name

+		 * or the caller won't be able to find it in cache. */

+		if (!krb5_principal_compare(ctx, self_princ,

+			store_creds->server)) {

+			krb5_free_principal(ctx, store_creds->server);

+			store_creds->server = NULL;

+			code = krb5_copy_principal(ctx, self_princ,

+						   &store_creds->server);

+			if (code != 0) {

+				goto done;

+			}

+		}

+	}

+

+	code = krb5_cc_initialize(ctx, store_cc, store_creds->client);

+	if (code != 0) {

+		goto done;

+	}

+

+	code = krb5_cc_store_cred(ctx, store_cc, store_creds);

+	if (code != 0) {

+		goto done;

+	}

+

+	if (expire_time) {

+		*expire_time = (time_t) store_creds->times.endtime;

+	}

+

+	if (kdc_time) {

+		*kdc_time = (time_t) store_creds->times.starttime;

+	}

+

+done:

+	krb5_cc_destroy(ctx, tmp_cc);

+	krb5_free_cred_contents(ctx, &init_creds);

+	krb5_free_creds(ctx, s4u2self_creds);

+	krb5_free_creds(ctx, s4u2proxy_creds);

+	krb5_free_principal(ctx, self_princ);

+	krb5_free_principal(ctx, target_princ);

+

+	return code;

+}

 #endif

 #if !defined(HAVE_KRB5_MAKE_PRINCIPAL) && defined(HAVE_KRB5_BUILD_PRINCIPAL_ALLOC_VA)

diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h

index eab67f6d969..b5385c69a33 100644

--- a/lib/krb5_wrap/krb5_samba.h

+++ b/lib/krb5_wrap/krb5_samba.h

@@ -252,7 +252,6 @@ krb5_error_code smb_krb5_kinit_password_ccache(krb5_context ctx,

 					       krb5_get_init_creds_opt *krb_options,

 					       time_t *expire_time,

 					       time_t *kdc_time);

-#ifdef SAMBA4_USES_HEIMDAL

 krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,

 					   krb5_ccache store_cc,

 					   krb5_principal init_principal,

@@ -263,7 +262,6 @@ krb5_error_code smb_krb5_kinit_s4u2_ccache(krb5_context ctx,

 					   krb5_get_init_creds_opt *krb_options,

 					   time_t *expire_time,

 					   time_t *kdc_time);

-#endif

 #if defined(HAVE_KRB5_MAKE_PRINCIPAL)

 #define smb_krb5_make_principal krb5_make_principal

diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c

index 544d9d853cc..c14d8c72d8c 100644

--- a/source4/auth/kerberos/kerberos_util.c

+++ b/source4/auth/kerberos/kerberos_util.c

@@ -234,9 +234,7 @@ done:

 {

 	krb5_error_code ret;

 	const char *password;

-#ifdef SAMBA4_USES_HEIMDAL

 	const char *self_service;

-#endif

 	const char *target_service;

 	time_t kdc_time = 0;

 	krb5_principal princ;

@@ -268,9 +266,7 @@ done:

 		return ret;

 	}

-#ifdef SAMBA4_USES_HEIMDAL

 	self_service = cli_credentials_get_self_service(credentials);

-#endif

 	target_service = cli_credentials_get_target_service(credentials);

 	password = cli_credentials_get_password(credentials);

@@ -331,7 +327,6 @@ done:

 #endif

 		if (password) {

 			if (impersonate_principal) {

-#ifdef SAMBA4_USES_HEIMDAL

 				ret = smb_krb5_kinit_s4u2_ccache(smb_krb5_context->krb5_context,

 								 ccache,

 								 princ,

@@ -342,12 +337,6 @@ done:

 								 krb_options,

 								 NULL,

 								 &kdc_time);

-#else

-				talloc_free(mem_ctx);

-				(*error_string) = "INTERNAL error: s4u2 ops "

-					"are not supported with MIT build yet";

-				return EINVAL;

-#endif

 			} else {

 				ret = smb_krb5_kinit_password_ccache(smb_krb5_context->krb5_context,

 								     ccache,

-- 

2.33.1

From f1951b501ca0fb3e613f04437c99dc1bbf204609 Mon Sep 17 00:00:00 2001

From: Isaac Boukris <iboukris@gmail.com>

Date: Sat, 19 Sep 2020 14:16:20 +0200

Subject: [PATCH 3/3] wip: for canonicalization with new MIT kdc code

---

 source4/heimdal/lib/hdb/hdb.h | 1 +

 source4/kdc/db-glue.c         | 8 ++++++--

 source4/kdc/mit_samba.c       | 3 +++

 source4/kdc/sdb.h             | 1 +

 4 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/source4/heimdal/lib/hdb/hdb.h b/source4/heimdal/lib/hdb/hdb.h

index 5ef9d9565f3..dafaffc6c2d 100644

--- a/source4/heimdal/lib/hdb/hdb.h

+++ b/source4/heimdal/lib/hdb/hdb.h

@@ -63,6 +63,7 @@ enum hdb_lockop{ HDB_RLOCK, HDB_WLOCK };

 #define HDB_F_ALL_KVNOS		2048	/* we want all the keys, live or not */

 #define HDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */

 #define HDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */

+#define HDB_F_FORCE_CANON	16384	/* force canonicalition */

 /* hdb_capability_flags */

 #define HDB_CAP_F_HANDLE_ENTERPRISE_PRINCIPAL 1

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c

index aff74f2ee71..d16b4c3329a 100644

--- a/source4/kdc/db-glue.c

+++ b/source4/kdc/db-glue.c

@@ -916,17 +916,21 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,

 			}

 		}

-	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) {

+	} else if (ent_type == SAMBA_KDC_ENT_TYPE_ANY && principal == NULL) { // was this supposed to be || ?

 		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);

 		if (ret) {

 			krb5_clear_error_message(context);

 			goto out;

 		}

-	} else if ((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) {

+	} else if (((flags & SDB_F_CANON) && (flags & SDB_F_FOR_AS_REQ)) || (flags & SDB_F_FORCE_CANON)){

 		/*

 		 * SDB_F_CANON maps from the canonicalize flag in the

 		 * packet, and has a different meaning between AS-REQ

 		 * and TGS-REQ.  We only change the principal in the AS-REQ case

+		 *

+		 * The SDB_F_FORCE_CANON if for the new MIT kdc code that wants

+		 * the canonical name in all lookups, and takes care to canonicalize

+		 * only when appropriate.

 		 */

 		ret = smb_krb5_make_principal(context, &entry_ex->entry.principal, lpcfg_realm(lp_ctx), samAccountName, NULL);

 		if (ret) {

diff --git a/source4/kdc/mit_samba.c b/source4/kdc/mit_samba.c

index acc3cba6254..f0b9df8b613 100644

--- a/source4/kdc/mit_samba.c

+++ b/source4/kdc/mit_samba.c

@@ -224,6 +224,9 @@ int mit_samba_get_principal(struct mit_samba_context *ctx,

 	if (kflags & KRB5_KDB_FLAG_CANONICALIZE) {

 		sflags |= SDB_F_CANON;

 	}

+#if KRB5_KDB_API_VERSION >= 10

+	sflags |= SDB_F_FORCE_CANON;

+#endif

 	if (kflags & (KRB5_KDB_FLAG_CLIENT_REFERRALS_ONLY |

 		      KRB5_KDB_FLAG_INCLUDE_PAC)) {

 		/*

diff --git a/source4/kdc/sdb.h b/source4/kdc/sdb.h

index c929acccce6..a9115ec23d7 100644

--- a/source4/kdc/sdb.h

+++ b/source4/kdc/sdb.h

@@ -116,6 +116,7 @@ struct sdb_entry_ex {

 #define SDB_F_KVNO_SPECIFIED	128	/* we want a particular KVNO */

 #define SDB_F_FOR_AS_REQ	4096	/* fetch is for a AS REQ */

 #define SDB_F_FOR_TGS_REQ	8192	/* fetch is for a TGS REQ */

+#define SDB_F_FORCE_CANON	16384	/* force canonicalition */

 void sdb_free_entry(struct sdb_entry_ex *e);

 void free_sdb_entry(struct sdb_entry *s);

-- 

2.33.1