s4-rodc: enable the DRS_GET_ALL_GROUP_MEMBERSHIP flag for RODC replication

see the description of this flag in [MS-DRSR]

diff --git a/source4/dsdb/kcc/kcc_periodic.c b/source4/dsdb/kcc/kcc_periodic.c
index fa2b0679dfb82e9d3f426d1eaa289dab9d79cb76..e0ac2c7786bbcbc3f0a943ef18a93b682b805d23 100644 (file)
--- a/source4/dsdb/kcc/kcc_periodic.c
+++ b/source4/dsdb/kcc/kcc_periodic.c
@@ -171,6 +171,7 @@ static uint32_t kccsrv_replica_flags(struct kccsrv_service *s)
                        DRSUAPI_DRS_PER_SYNC |
                        DRSUAPI_DRS_ADD_REF |
                        DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
+                       DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP |
                        DRSUAPI_DRS_NONGC_RO_REP;
        }
        return DRSUAPI_DRS_INIT_SYNC |

diff --git a/source4/scripting/python/samba/join.py b/source4/scripting/python/samba/join.py
index 8db00bc47d414b46d12ea3cac2e1d8312bd54f66..deeedc5ad38f99885966fd2ca4ac44e2ed86b78a 100644 (file)
--- a/source4/scripting/python/samba/join.py
+++ b/source4/scripting/python/samba/join.py
@@ -545,7 +545,8 @@ def join_RODC(server=None, creds=None, lp=None, site=None, netbios_name=None,
                            drsuapi.DRSUAPI_DRS_PER_SYNC |
                            drsuapi.DRSUAPI_DRS_GET_ANC |
                            drsuapi.DRSUAPI_DRS_NEVER_SYNCED |
-                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING)
+                           drsuapi.DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING |
+                           drsuapi.DRSUAPI_DRS_GET_ALL_GROUP_MEMBERSHIP)
     ctx.do_join()