r20406: Metze's change in -r 19662 broke Kerberos logins from Win2k3.

[jelmer/samba4-debian.git] / source / kdc / hdb-ldb.c

diff --git a/source/kdc/hdb-ldb.c b/source/kdc/hdb-ldb.c
index f7bbbb9a9b52af20f72281250a92ec67624aae6d..a05295205b7cab0a20a96319ad4383a69f1c3618 100644 (file)
--- a/source/kdc/hdb-ldb.c
+++ b/source/kdc/hdb-ldb.c
@@ -630,6 +630,7 @@ static krb5_error_code LDB_fetch_krbtgt(krb5_context context, HDB *db,
        struct ldb_message **realm_ref_msg = NULL;
        struct ldb_dn *realm_dn;
 
+       krb5_principal alloc_principal = NULL;
        if (principal->name.name_string.len != 2
            || (strcmp(principal->name.name_string.val[0], KRB5_TGS_NAME) != 0)) {
                /* Not a krbtgt */
@@ -640,6 +641,30 @@ static krb5_error_code LDB_fetch_krbtgt(krb5_context context, HDB *db,
        if ((LDB_lookup_realm(context, (struct ldb_context *)db->hdb_db,
                              mem_ctx, principal->name.name_string.val[1], &realm_ref_msg) == 0)) {
                /* us */                
+               /* Cludge, cludge cludge.  If the realm part of krbtgt/realm,
+                * is in our db, then direct the caller at our primary
+                * krgtgt */
+               
+               const char *dnsdomain = ldb_msg_find_attr_as_string(realm_ref_msg[0], "dnsRoot", NULL);
+               char *realm_fixed = strupper_talloc(mem_ctx, dnsdomain);
+               if (!realm_fixed) {
+                       krb5_set_error_string(context, "strupper_talloc: out of memory");
+                       return ENOMEM;
+               }
+               
+               ret = krb5_copy_principal(context, principal, &alloc_principal);
+               if (ret) {
+                       return ret;
+               }
+ 
+               free(alloc_principal->name.name_string.val[1]);
+               alloc_principal->name.name_string.val[1] = strdup(realm_fixed);
+               talloc_free(realm_fixed);
+               if (!alloc_principal->name.name_string.val[1]) {
+                       krb5_set_error_string(context, "LDB_fetch: strdup() failed!");
+                       return ENOMEM;
+               }
+               principal = alloc_principal;
                realm_dn = samdb_result_dn((struct ldb_context *)db->hdb_db, mem_ctx, realm_ref_msg[0], "nCName", NULL);
        } else {
                /* we should lookup trusted domains */