mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2026-10-25 14:40:16 -05:00
Alexander Bokovoy
ae8e850708
Samba 4.23 ignores trust to PIM and 'within the forest' domains. It didn't know what to do with them in past as well but starting with 4.23 the domain trust entries which have trust attributes with LSA_TRUST_ATTRIBUTE_PIM_TRUST and LSA_TRUST_ATTRIBUTE_WITHIN_FOREST bits set will be ignored. FreeIPA did default to LSA_TRUST_ATTRIBUTE_WITHIN_FOREST for domains stored with trusted attributes set to 0 or missing. This was behavior in past for Samba as well. Since FreeIPA only supports forest trust and an external trust, in both cases we should set explicit LSA trust attribute bits: - LSA_TRUST_ATTRIBUTE_FOREST_TRANSITIVE for the forest trust - LSA_TRUST_ATTRIBUTE_NON_TRANSITIVE for the external trust Fixes: https://pagure.io/freeipa/issue/9852 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com>