s4:kdc: Add device to Authenticated Users for authentication policy evaluation

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Tue Oct 24 01:59:32 UTC 2023 on atb-devel-224

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index dcda95954ba840c0d2ca7ae736fc6327ad9de149..3792f7ea5b919a8c4be8e33cc2f9e9c0e599cdfb 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -132,5 +132,4 @@
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_both_from_rodc\(ad_dc\)
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_client_from_rodc\(ad_dc\)
 ^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.DeviceRestrictionTests\.test_device_in_network_group\(ad_dc\)$
-^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.TgsReqServicePolicyTests\.test_device_in_authenticated_users\(ad_dc\)$
 ^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.TgsReqServicePolicyTests\.test_device_in_network_group\(ad_dc\)$

diff --git a/source4/kdc/authn_policy_util.c b/source4/kdc/authn_policy_util.c
index 46d1aa352a4a1fe34981efe00f58c680a5da1110..60de61a27c24c6a3c573760f4799a8b0f73a16bf 100644 (file)
--- a/source4/kdc/authn_policy_util.c
+++ b/source4/kdc/authn_policy_util.c
@@ -595,6 +595,10 @@ static NTSTATUS _authn_policy_access_check(TALLOC_CTX *mem_ctx,
                session_info_flags |= AUTH_SESSION_INFO_AUTHENTICATED;
        }
 
+       if (device_info != NULL && !(device_info->info->user_flags & NETLOGON_GUEST)) {
+               session_info_flags |= AUTH_SESSION_INFO_DEVICE_AUTHENTICATED;
+       }
+
        if (authn_policy_flags.force_compounded_authentication) {
                session_info_flags |= AUTH_SESSION_INFO_FORCE_COMPOUNDED_AUTHENTICATION;
        }