From 075f061ca337d516a82b0fb19b001ff8cff61915 Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 7 Nov 2017 12:23:31 +0100
Subject: TODO s4:kdc: msDS-SupportedEncryptionTypes only on computers

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13135
---
 source4/kdc/db-glue.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

(limited to 'source4')

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index bf55befddf8..2b7b5d6823c 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -288,6 +288,14 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
 					    "msDS-SupportedEncryptionTypes",
 					    0);
 
+	if (userAccountControl & UF_NORMAL_ACCOUNT) {
+		supported_enctypes = 0;
+	}
+	if (supported_enctypes == 0) {
+		/* Otherwise, add in the default enc types */
+		supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
+	}
+
 	if (rid == DOMAIN_RID_KRBTGT || is_rodc) {
 		/* KDCs (and KDCs on RODCs) use AES */
 		supported_enctypes |= ENC_HMAC_SHA1_96_AES128 | ENC_HMAC_SHA1_96_AES256;
@@ -308,7 +316,7 @@ static krb5_error_code samba_kdc_message2entry_keys(krb5_context context,
 	/* If UF_USE_DES_KEY_ONLY has been set, then don't allow use of the newer enc types */
 	if (userAccountControl & UF_USE_DES_KEY_ONLY) {
 		supported_enctypes = ENC_CRC32|ENC_RSA_MD5;
-	} else {
+	} else if (supported_enctypes == 0) {
 		/* Otherwise, add in the default enc types */
 		supported_enctypes |= ENC_CRC32 | ENC_RSA_MD5 | ENC_RC4_HMAC_MD5;
 	}
-- 
cgit v1.2.1