s4-auth/kerberos: add a note how to implement krb5_get_init_creds_opt_set_win2k(...

Guenther

Signed-off-by: Günther Deschner <gd@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/auth/kerberos/kerberos_util.c b/source4/auth/kerberos/kerberos_util.c
index b65a2adc5efc2327bf3fc2ab149c430489c32819..c2e48fd51550e0e417e4403c2ae2f822b0f52177 100644 (file)
--- a/source4/auth/kerberos/kerberos_util.c
+++ b/source4/auth/kerberos/kerberos_util.c
@@ -218,6 +218,8 @@ static krb5_error_code impersonate_principal_from_credentials(
         * flags:
         * KRB5_INIT_CREDS_NO_C_CANON_CHECK;
         * KRB5_INIT_CREDS_NO_C_NO_EKU_CHECK;
+        *
+        * On MIT: Set pkinit_eku_checking to none
         */
        krb5_get_init_creds_opt_set_win2k(smb_krb5_context->krb5_context,
                                          krb_options, true);