[PATCH] Improved tests for the Samba KDC

[Andrew Bartlett]

I've reworked our tests to cover more combinations, in particular an
interesting one that came up via a client of having a UPN being the
same as the SPN.

The patches are attached, and here:
https://gitlab.com/samba-team/samba/merge_requests/55

I'm doing this to prepare again for a Heimdal upgrade, and to lock down
our required behaviour better.

Comment welcome.  While they are ready for master now, I would like to
try and fix the remaining knownfail entries. 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett
https://samba.org/~abartlet/
Authentication Developer, Samba Team         https://samba.org
Samba Development and Support, Catalyst IT   
https://catalyst.net.nz/services/samba



-------------- next part --------------
From afd91b99e4da10295142d5bc6f92a53f15cffbda Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet at samba.org>
Date: Thu, 16 Nov 2017 14:01:56 +1300
Subject: [PATCH 1/5] torture: Add tests to prove that kinit to an SPN is not
 allowed (unless it is also a UPN)

The krb5.kdc.canon testsuite has been updated to pass against Windows
Server 1709 in four modes:

* A normal user
* A user with a UPN
* A user with an SPN (machine account)
* A user with an SPN as the UPN

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 source4/torture/krb5/kdc-canon-heimdal.c | 348 +++++++++++++++++++++++++++----
 1 file changed, 309 insertions(+), 39 deletions(-)

diff --git a/source4/torture/krb5/kdc-canon-heimdal.c b/source4/torture/krb5/kdc-canon-heimdal.c
index 5b782a23fc4..848d0f8b09c 100644
--- a/source4/torture/krb5/kdc-canon-heimdal.c
+++ b/source4/torture/krb5/kdc-canon-heimdal.c
@@ -43,7 +43,8 @@
 #define TEST_UPN              0x0000040
 #define TEST_S4U2SELF         0x0000080
 #define TEST_REMOVEDOLLAR     0x0000100
-#define TEST_ALL              0x00001FF
+#define TEST_AS_REQ_SPN       0x0000200
+#define TEST_ALL              0x00003FF
 
 struct test_data {
 	const char *test_name;
@@ -62,6 +63,8 @@ struct test_data {
 	bool other_upn_suffix;
 	bool s4u2self;
 	bool removedollar;
+	bool as_req_spn;
+	bool spn_is_upn;
 	const char *krb5_service;
 	const char *krb5_hostname;
 };
@@ -238,7 +241,8 @@ static bool torture_krb5_pre_send_as_req_test(struct torture_krb5_context *test_
 	torture_assert_int_equal(test_context->tctx, used, send_buf->length, "length mismatch");
 	torture_assert_int_equal(test_context->tctx, test_context->as_req.pvno,
 				 5, "Got wrong as_req->pvno");
-	if (test_context->test_data->canonicalize || test_context->test_data->enterprise) {
+	if (test_context->test_data->canonicalize
+	    || test_context->test_data->enterprise) {
 		torture_assert(test_context->tctx,
 			       test_context->as_req.req_body.kdc_options.canonicalize,
 			       "krb5 libs did not set canonicalize!");
@@ -249,7 +253,23 @@ static bool torture_krb5_pre_send_as_req_test(struct torture_krb5_context *test_
 					 "krb5 libs unexpectedly set canonicalize!");
 	}
 
-	if (test_context->test_data->enterprise) {
+	if (test_context->test_data->as_req_spn) {
+		if (test_context->test_data->upn) {
+			torture_assert_int_equal(test_context->tctx,
+						 test_context->as_req.req_body.cname->name_type,
+						 KRB5_NT_PRINCIPAL,
+						 "krb5 libs unexpectedly "
+						 "did not set principal "
+						 "as NT_SRV_HST!");
+		} else {
+			torture_assert_int_equal(test_context->tctx,
+						 test_context->as_req.req_body.cname->name_type,
+						 KRB5_NT_SRV_HST,
+						 "krb5 libs unexpectedly "
+						 "did not set principal "
+						 "as NT_SRV_HST!");
+		}
+	} else if (test_context->test_data->enterprise) {
 		torture_assert_int_equal(test_context->tctx,
 					 test_context->as_req.req_body.cname->name_type,
 					 KRB5_NT_ENTERPRISE_PRINCIPAL,
@@ -351,6 +371,11 @@ static bool torture_krb5_post_recv_as_req_test(struct torture_krb5_context *test
 						 error.error_code,
 						 KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN - KRB5KDC_ERR_NONE,
 						 "Got wrong error.error_code");
+		} else if (test_context->test_data->as_req_spn && !test_context->test_data->spn_is_upn) {
+			torture_assert_int_equal(test_context->tctx,
+						 error.error_code,
+						 KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN - KRB5KDC_ERR_NONE,
+						 "Got wrong error.error_code");
 		} else {
 			torture_assert_int_equal(test_context->tctx,
 						 error.error_code,
@@ -580,6 +605,14 @@ static bool torture_krb5_pre_send_tgs_req_canon_test(struct torture_krb5_context
 					 test_context->tgs_req.req_body.realm, test_context->test_data->real_realm,
 				 "Mismatch in realm between request and expected request");
 
+	} else if (test_context->test_data->as_req_spn) {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.sname->name_type, KRB5_NT_SRV_HST,
+					 "Mismatch in name type between request and expected request, expected  KRB5_NT_SRV_HST");
+		torture_assert_str_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.realm, test_context->test_data->real_realm,
+				 "Mismatch in realm between request and expected request");
+
 	} else if (test_context->test_data->canonicalize) {
 		torture_assert_int_equal(test_context->tctx,
 					 test_context->tgs_req.req_body.sname->name_type, KRB5_NT_PRINCIPAL,
@@ -704,7 +737,22 @@ static bool torture_krb5_pre_send_self_trust_tgs_req_test(struct torture_krb5_co
 				 0, "decode_TGS_REQ for TEST_SELF_TRUST_TGS_REQ test failed");
 	torture_assert_int_equal(test_context->tctx, used, send_buf->length, "length mismatch");
 	torture_assert_int_equal(test_context->tctx, test_context->tgs_req.pvno, 5, "Got wrong as_req->pvno");
-	torture_assert_int_equal(test_context->tctx, test_context->tgs_req.req_body.kdc_options.canonicalize, false, "krb5 libs unexpectedly set canonicalize!");
+
+	if (test_context->test_data->enterprise
+	    || (test_context->test_data->spn_is_upn && test_context->test_data->upn)) {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.kdc_options.canonicalize,
+					 true,
+					 "krb5 libs unexpectedly"
+					 " did not set canonicalize!");
+	} else {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.kdc_options.canonicalize,
+					 false,
+					 "krb5 libs unexpectedly"
+					 " set canonicalize!");
+	}
+	
 
 	if (test_context->test_data->canonicalize) {
 		torture_assert_str_equal(test_context->tctx,
@@ -829,11 +877,23 @@ static bool torture_krb5_pre_send_tgs_req_test(struct torture_krb5_context *test
 	torture_assert_int_equal(test_context->tctx, used, send_buf->length, "length mismatch");
 	torture_assert_int_equal(test_context->tctx, test_context->tgs_req.pvno, 5,
 				 "Got wrong as_req->pvno");
-	torture_assert_int_equal(test_context->tctx,
-				 test_context->tgs_req.req_body.kdc_options.canonicalize,
-				 false,
-				 "krb5 libs unexpectedly set canonicalize!");
 
+	if (test_context->test_data->enterprise
+	    && test_context->test_data->s4u2self == false
+	    && test_context->test_data->spn_is_upn) {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.kdc_options.canonicalize,
+					 true,
+					 "krb5 libs unexpectedly"
+					 " did not set canonicalize!");
+	} else {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.kdc_options.canonicalize,
+					 false,
+					 "krb5 libs unexpectedly"
+					 " set canonicalize!");
+	}
+	
 	if (test_context->test_data->enterprise) {
 		torture_assert_int_equal(test_context->tctx,
 					 test_context->tgs_req.req_body.sname->name_type,
@@ -844,6 +904,28 @@ static bool torture_krb5_pre_send_tgs_req_test(struct torture_krb5_context *test
 					 test_context->test_data->real_realm,
 					 "Mismatch in realm between request and expected request");
 
+	} else if (test_context->test_data->spn_is_upn && test_context->test_data->upn && test_context->test_data->canonicalize) {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.sname->name_type,
+					 KRB5_NT_PRINCIPAL,
+					 "Mismatch in name type between request and expected request, expected  KRB5_NT_PRINCIPAL");
+		torture_assert_str_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.realm,
+					 test_context->test_data->real_realm,
+					 "Mismatch in realm between request and expected request");
+
+	} else if (test_context->test_data->spn_is_upn
+		   && test_context->test_data->as_req_spn
+		   && test_context->test_data->canonicalize == false) {
+		torture_assert_int_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.sname->name_type,
+					 KRB5_NT_SRV_HST,
+					 "Mismatch in name type between request and expected request, expected  KRB5_NT_SRV_HST");
+		torture_assert_str_equal(test_context->tctx,
+					 test_context->tgs_req.req_body.realm,
+					 test_context->test_data->realm,
+					 "Mismatch in realm between request and expected request");
+
 	} else {
 		torture_assert_int_equal(test_context->tctx,
 					 test_context->tgs_req.req_body.sname->name_type,
@@ -1191,7 +1273,12 @@ static bool torture_krb5_post_recv_as_req_self_test(struct torture_krb5_context
 					 error.pvno, 5,
 					 "Got wrong error.pvno");
 		if ((torture_setting_bool(test_context->tctx, "expect_machine_account", false)
-		     && (test_context->test_data->upn == false))) {
+		     && ((test_context->test_data->upn == false)
+			 || (test_context->test_data->as_req_spn &&
+			     test_context->test_data->spn_is_upn)
+			 || (test_context->test_data->enterprise == false &&
+			     test_context->test_data->upn &&
+			    test_context->test_data->spn_is_upn)))) {
 			torture_assert_int_equal(test_context->tctx,
 						 error.error_code,
 						 KRB5KRB_ERR_RESPONSE_TOO_BIG - KRB5KDC_ERR_NONE,
@@ -1415,10 +1502,10 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	krb5_principal principal;
 	krb5_principal krbtgt_other;
 	krb5_principal expected_principal;
-	char *principal_string;
+	const char *principal_string = NULL;
 	char *krbtgt_other_string;
 	int principal_flags;
-	char *expected_principal_string;
+	const char *expected_principal_string = NULL;
 	char *expected_unparse_principal_string;
 	int expected_principal_flags;
 	char *got_principal_string;
@@ -1436,6 +1523,8 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	krb5_data in_data, enc_ticket;
 	krb5_get_creds_opt opt;
 
+	const char *spn = NULL;
+	const char *spn_real_realm = NULL;
 	const char *upn = torture_setting_string(tctx, "krb5-upn", "");
 	test_data->krb5_service = torture_setting_string(tctx, "krb5-service", "host");
 	test_data->krb5_hostname = torture_setting_string(tctx, "krb5-hostname", "");
@@ -1448,6 +1537,14 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 		torture_skip(tctx, "This test needs a UPN specified as --option=torture:krb5-upn=user at example.com to run");
 	}
 
+	/*
+	 * If we have not passed a SPN on the command line,
+	 * then skip the SPN tests.
+	 */
+	if (test_data->as_req_spn && test_data->krb5_hostname[0] == '\0') {
+		torture_skip(tctx, "This test needs a hostname specified as --option=torture:krb5-hostname=hostname.example.com and optinally --option=torture:krb5-service=service (defaults to host) to run");
+	}
+
 	if (test_data->removedollar &&
 	    !torture_setting_bool(tctx, "run_removedollar_test", false))
 	{
@@ -1520,8 +1617,34 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 		*p = '\0';
 	}
 
-	principal_string = talloc_asprintf(test_data, "%s@%s", test_data->username, test_data->realm);
+	spn = talloc_asprintf(test_data, "%s/%s@%s",
+			      test_data->krb5_service,
+			      test_data->krb5_hostname,
+			      test_data->realm);
+
+	spn_real_realm = talloc_asprintf(test_data, "%s/%s@%s",
+					 test_data->krb5_service,
+					 test_data->krb5_hostname,
+					 test_data->real_realm);
+
+	if (test_data->as_req_spn) {
+		if (test_data->enterprise) {
+			torture_skip(tctx,
+				     "This test combination "
+				     "is skipped intentionally");
+		}
+		principal_string = spn;
+	} else {
+		principal_string = talloc_asprintf(test_data,
+						   "%s@%s",
+						   test_data->username,
+						   test_data->realm);
+		
+	}
 
+	test_data->spn_is_upn
+		= (strcasecmp(upn, spn) == 0);
+				
 	/*
 	 * If we are set to canonicalize, we get back the fixed UPPER
 	 * case realm, and the real username (ie matching LDAP
@@ -1533,13 +1656,17 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	 * Finally, if we are not set to canonicalize, we get back the
 	 * fixed UPPER case realm, but the as-sent username
 	 */
-	if (test_data->canonicalize) {
+	if (test_data->as_req_spn && !test_data->spn_is_upn) {
+		expected_principal_string = spn;
+	} else if (test_data->canonicalize) {
 		expected_principal_string = talloc_asprintf(test_data,
 							    "%s@%s",
 							    test_data->real_username,
 							    test_data->real_realm);
 	} else if (test_data->enterprise) {
 		expected_principal_string = principal_string;
+	} else if (test_data->as_req_spn && test_data->spn_is_upn) {
+		expected_principal_string = spn_real_realm;
 	} else {
 		expected_principal_string = talloc_asprintf(test_data,
 							    "%s@%s",
@@ -1574,7 +1701,25 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 						       expected_principal_flags,
 						       &expected_principal),
 				 0, "krb5_parse_name_flags failed");
-
+	
+	if (test_data->as_req_spn) {
+		if (test_data->upn) {
+			krb5_principal_set_type(k5_context,
+						principal,
+						KRB5_NT_PRINCIPAL);
+			krb5_principal_set_type(k5_context,
+						expected_principal,
+						KRB5_NT_PRINCIPAL);
+		} else {
+			krb5_principal_set_type(k5_context,
+						principal,
+						KRB5_NT_SRV_HST);
+			krb5_principal_set_type(k5_context,
+						expected_principal,
+						KRB5_NT_SRV_HST);
+		}
+	}
+	
 	torture_assert_int_equal(tctx,
 				 krb5_unparse_name(k5_context,
 						   expected_principal,
@@ -1617,6 +1762,14 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 					 "Got wrong error_code from krb5_get_init_creds_password");
 		/* We can't proceed with more checks */
 		return true;
+	} else if (test_context->test_data->as_req_spn
+		   && !test_context->test_data->spn_is_upn) {
+		torture_assert_int_equal(tctx, k5ret,
+					 KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN,
+					 "Got wrong error_code from "
+					 "krb5_get_init_creds_password");
+		/* We can't proceed with more checks */
+		return true;
 	} else {
 		assertion_message = talloc_asprintf(tctx,
 						    "krb5_get_init_creds_password for %s failed: %s",
@@ -1639,6 +1792,12 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 								 my_creds.client),
 					 KRB5_NT_ENTERPRISE_PRINCIPAL,
 					 "smb_krb5_init_context gave incorrect client->name.name_type");
+	} else if (test_data->canonicalize == false && test_data->as_req_spn) {
+		torture_assert_int_equal(tctx,
+					 krb5_principal_get_type(k5_context,
+								 my_creds.client),
+					 KRB5_NT_SRV_HST,
+					 "smb_krb5_init_context gave incorrect client->name.name_type");
 	} else {
 		torture_assert_int_equal(tctx,
 					 krb5_principal_get_type(k5_context,
@@ -1844,7 +2003,9 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 		 * servicePrincipalName) can expect this test to succeed
 		 */
 		if (torture_setting_bool(tctx, "expect_machine_account", false)
-		    && (test_data->enterprise || test_data->upn == false)) {
+		    && (test_data->enterprise
+			|| test_data->spn_is_upn
+			|| test_data->upn == false)) {
 			torture_assert_int_equal(tctx, k5ret, 0, assertion_message);
 			torture_assert_int_equal(tctx, krb5_cc_store_cred(k5_context,
 									  ccache, server_creds),
@@ -1882,6 +2043,7 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	 */
 	if (test_context->test_data->canonicalize == false
 	    || test_context->test_data->enterprise
+	    || (test_context->test_data->spn_is_upn && test_context->test_data->upn)
 	    || (test_context->test_data->upper_realm
 		&& test_context->test_data->netbios_realm == false)) {
 		test_context->test_stage = TEST_TGS_REQ;
@@ -1909,16 +2071,77 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	 * Only machine accounts (strictly, accounts with a
 	 * servicePrincipalName) can expect this test to succeed
 	 */
-	if (torture_setting_bool(tctx, "expect_machine_account", false) && (test_data->enterprise || test_data->upn == false)) {
+	if (torture_setting_bool(tctx, "expect_machine_account", false)
+	    && (test_data->enterprise ||
+		(test_context->test_data->as_req_spn 
+		 || test_context->test_data->spn_is_upn)
+		|| test_data->upn == false)) {
 		DATA_BLOB client_to_server;
 		torture_assert_int_equal(tctx, k5ret, 0, assertion_message);
 		client_to_server = data_blob_const(enc_ticket.data, enc_ticket.length);
-		torture_assert(tctx,
-			       test_accept_ticket(tctx,
-					popt_get_cmdline_credentials(),
-						  expected_unparse_principal_string,
-						  client_to_server),
-			       "test_accept_ticket failed - failed to accept the ticket we just created");
+
+		/* This is very weird */
+		if (test_data->canonicalize == false
+		    && test_context->test_data->as_req_spn
+		    && test_context->test_data->spn_is_upn
+		    && test_context->test_data->s4u2self) {
+			
+			torture_assert(tctx,
+				       test_accept_ticket(tctx,
+							  popt_get_cmdline_credentials(),
+							  spn_real_realm,
+							  client_to_server),
+				       "test_accept_ticket failed - failed to accept the ticket we just created");
+		} else if (test_data->canonicalize == true
+		    && test_context->test_data->as_req_spn
+		    && test_context->test_data->spn_is_upn
+		    && test_context->test_data->s4u2self) {
+			
+			torture_assert(tctx,
+				       test_accept_ticket(tctx,
+							  popt_get_cmdline_credentials(),
+							  spn,
+							  client_to_server),
+				       "test_accept_ticket failed - failed to accept the ticket we just created");
+		} else if (test_data->canonicalize == true
+			   && test_data->enterprise == false
+			   && test_context->test_data->upn
+			   && test_context->test_data->spn_is_upn
+			   && test_context->test_data->s4u2self) {
+			
+			torture_assert(tctx,
+				       test_accept_ticket(tctx,
+							  popt_get_cmdline_credentials(),
+							  principal_string,
+							  client_to_server),
+				       "test_accept_ticket failed - failed to accept the ticket we just created");
+		} else if (test_data->canonicalize == false
+			   && test_data->enterprise == false
+			   && test_context->test_data->upn
+			   && test_context->test_data->spn_is_upn
+			   && test_context->test_data->s4u2self) {
+			
+			const char *accept_expected_principal_string
+				= talloc_asprintf(test_data,
+						  "%s@%s",
+						  test_data->username,
+						  test_data->real_realm);
+			
+			torture_assert(tctx,
+				       test_accept_ticket(tctx,
+							  popt_get_cmdline_credentials(),
+							  accept_expected_principal_string,
+							  client_to_server),
+				       "test_accept_ticket failed - failed to accept the ticket we just created");
+		} else {
+		
+			torture_assert(tctx,
+				       test_accept_ticket(tctx,
+							  popt_get_cmdline_credentials(),
+							  expected_unparse_principal_string,
+							  client_to_server),
+				       "test_accept_ticket failed - failed to accept the ticket we just created");
+		}
 		krb5_data_free(&enc_ticket);
 	} else {
 		torture_assert_int_equal(tctx, k5ret, KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN,
@@ -1947,6 +2170,7 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	 */
 
 	if (*test_data->krb5_service && *test_data->krb5_hostname) {
+		bool implied_canonicalize;
 		krb5_principal host_principal_srv_inst;
 		/*
 		 * This tries to guess when the krb5 libs will ask for a
@@ -1967,25 +2191,45 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 				    &in_data, ccache,
 				    &enc_ticket);
 
-		if (test_data->canonicalize == false && test_data->enterprise == false
+		implied_canonicalize = test_data->canonicalize;
+		if (test_data->spn_is_upn && (test_data->upn || test_data->as_req_spn)) {
+			implied_canonicalize = true;
+		}
+		if (test_data->enterprise) {
+			implied_canonicalize = true;
+		}
+
+		if (implied_canonicalize == false
 		    && (test_data->upper_realm == false || test_data->netbios_realm == true)) {
 			torture_assert_int_equal(tctx, k5ret, KRB5_CC_NOTFOUND,
 						 "krb5_get_creds should have failed with KRB5_CC_NOTFOUND");
+		} else if (test_data->spn_is_upn
+			   && test_data->canonicalize == false
+			   && test_data->enterprise == false
+			   && test_data->upper_realm == false
+			   && test_data->upper_username == true
+			   && test_data->upn) {
+			torture_assert_int_equal(tctx, k5ret, KRB5_CC_NOTFOUND,
+						 "krb5_get_creds should have failed with KRB5_CC_NOTFOUND");
 		} else {
 			assertion_message = talloc_asprintf(tctx,
 							    "krb5_mk_req for %s/%s failed: %s",
-							    test_data->krb5_hostname,
 							    test_data->krb5_service,
+							    test_data->krb5_hostname,
 							    smb_get_krb5_error_message(k5_context, k5ret, tctx));
 
 			torture_assert_int_equal(tctx, k5ret, 0, assertion_message);
-			/*
-			 * Only in these cases would the above code have needed to
-			 * send packets to the network
-			 */
-			torture_assert(tctx,
-				       test_context->packet_count > 0,
-				       "Expected krb5_get_creds to send packets");
+
+			if (test_data->spn_is_upn == false) {
+				/*
+				 * Only in these cases would the above
+				 * code have needed to send packets to
+				 * the network
+				 */
+				torture_assert(tctx,
+					       test_context->packet_count > 0,
+					       "Expected krb5_get_creds to send packets");
+			}
 		}
 
 
@@ -2118,7 +2362,8 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 					     password, NULL, NULL, 0,
 					     principal_string, krb_options);
 
-	if (torture_setting_bool(test_context->tctx, "expect_machine_account", false) && (test_data->upn == false)) {
+	if (torture_setting_bool(test_context->tctx, "expect_machine_account", false)
+	    && (test_data->upn == false || (test_data->enterprise == false && test_data->upn == true && test_data->spn_is_upn))) {
 		assertion_message = talloc_asprintf(tctx,
 						    "krb5_get_init_creds_password for %s failed: %s",
 						    principal_string,
@@ -2146,7 +2391,18 @@ static bool torture_krb5_as_req_canon(struct torture_context *tctx, const void *
 	 * Assert that the reply was with the correct type of
 	 * principal, depending on the flags we set
 	 */
-	if (test_data->canonicalize == false && test_data->enterprise) {
+	if (test_data->as_req_spn && test_data->spn_is_upn && test_data->canonicalize == false) {
+		torture_assert_int_equal(tctx,
+					 krb5_principal_get_type(k5_context,
+								 my_creds.client),
+					 KRB5_NT_SRV_HST,
+					 "smb_krb5_init_context gave incorrect client->name.name_type");
+		torture_assert_int_equal(tctx,
+					 krb5_principal_get_type(k5_context,
+								 my_creds.server),
+					 KRB5_NT_SRV_HST,
+					 "smb_krb5_init_context gave incorrect server->name.name_type");
+	} else if (test_data->canonicalize == false && test_data->enterprise) {
 		torture_assert_int_equal(tctx,
 					 krb5_principal_get_type(k5_context,
 								 my_creds.client),
@@ -2214,19 +2470,31 @@ struct torture_suite *torture_krb5_canon(TALLOC_CTX *mem_ctx)
 	suite->description = talloc_strdup(suite, "Kerberos Canonicalisation tests");
 
 	for (i = 0; i < TEST_ALL; i++) {
-		char *name = talloc_asprintf(suite, "%s.%s.%s.%s.%s.%s.%s.%s.%s",
+		char *name = talloc_asprintf(suite, "%s.%s.%s.%s.%s.%s.%s.%s",
 					     (i & TEST_CANONICALIZE) ? "canon" : "no-canon",
 					     (i & TEST_ENTERPRISE) ? "enterprise" : "no-enterprise",
 					     (i & TEST_UPPER_REALM) ? "uc-realm" : "lc-realm",
 					     (i & TEST_UPPER_USERNAME) ? "uc-user" : "lc-user",
 					     (i & TEST_NETBIOS_REALM) ? "netbios-realm" : "krb5-realm",
 					     (i & TEST_WIN2K) ? "win2k" : "no-win2k",
-					     (i & TEST_UPN) ? "upn" : "no-upn",
-					     (i & TEST_S4U2SELF) ? "s4u2self" : "normal",
-					     (i & TEST_REMOVEDOLLAR) ? "removedollar" : "keepdollar");
+					     (i & TEST_UPN) ? "upn" :
+					     ((i & TEST_AS_REQ_SPN) ? "spn" : 
+					      ((i & TEST_REMOVEDOLLAR) ? "removedollar" : "samaccountname")),
+					     (i & TEST_S4U2SELF) ? "s4u2self" : "normal");
+		struct torture_suite *sub_suite = torture_suite_create(mem_ctx, name);
 
 		struct test_data *test_data = talloc_zero(suite, struct test_data);
-
+		if (i & TEST_UPN) {
+			if (i & TEST_AS_REQ_SPN) {
+				continue;
+			}
+		}
+		if ((i & TEST_UPN) || (i & TEST_AS_REQ_SPN)) {
+			if (i & TEST_REMOVEDOLLAR) {
+				continue;
+			}
+		}
+		
 		test_data->test_name = name;
 		test_data->real_realm
 			= strupper_talloc(test_data,
@@ -2247,8 +2515,10 @@ struct torture_suite *torture_krb5_canon(TALLOC_CTX *mem_ctx)
 		test_data->upn = (i & TEST_UPN) != 0;
 		test_data->s4u2self = (i & TEST_S4U2SELF) != 0;
 		test_data->removedollar = (i & TEST_REMOVEDOLLAR) != 0;
-		torture_suite_add_simple_tcase_const(suite, name, torture_krb5_as_req_canon,
+		test_data->as_req_spn = (i & TEST_AS_REQ_SPN) != 0;
+		torture_suite_add_simple_tcase_const(sub_suite, name, torture_krb5_as_req_canon,
 						     test_data);
+		torture_suite_add_suite(suite, sub_suite);
 
 	}
 	return suite;
-- 
2.11.0


From cf12889f10563287cd42f8835e54e70d6d882797 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet at samba.org>
Date: Mon, 27 Aug 2018 10:54:02 +1200
Subject: [PATCH 2/5] Add knownfail for new KDC tests

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 selftest/knownfail.d/kdc | 320 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 320 insertions(+)
 create mode 100644 selftest/knownfail.d/kdc

diff --git a/selftest/knownfail.d/kdc b/selftest/knownfail.d/kdc
new file mode 100644
index 00000000000..38f0615133a
--- /dev/null
+++ b/selftest/knownfail.d/kdc
@@ -0,0 +1,320 @@
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-- 
2.11.0


From dcd8dcc0ec600b4866e2056aef0ce1246a241a04 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet at samba.org>
Date: Thu, 30 Nov 2017 16:30:49 +1300
Subject: [PATCH 3/5] Revert "s4/heimdal: allow SPNs in AS-REQ"

This reverts commit 20dc68050df7b1b0c9d06f8251183a0a6283fcaf.

Tests (the krb5.kdc testsuite) show this behaviour is incorrect.

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 selftest/knownfail.d/kdc        | 320 ----------------------------------------
 source4/heimdal/kdc/kerberos5.c |   6 +-
 2 files changed, 3 insertions(+), 323 deletions(-)
 delete mode 100644 selftest/knownfail.d/kdc

diff --git a/selftest/knownfail.d/kdc b/selftest/knownfail.d/kdc
deleted file mode 100644
index 38f0615133a..00000000000
--- a/selftest/knownfail.d/kdc
+++ /dev/null
@@ -1,320 +0,0 @@
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with account ALLOWED permission to replicate to an RODC.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.normal
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.no-win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.lc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.lc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.no-canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
-^samba4.krb5.kdc with machine account.canon.no-enterprise.uc-realm.uc-user.netbios-realm.win2k.spn.s4u2self
diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c
index 12187dde429..a3ba5fef0ee 100644
--- a/source4/heimdal/kdc/kerberos5.c
+++ b/source4/heimdal/kdc/kerberos5.c
@@ -762,9 +762,9 @@ kdc_check_flags(krb5_context context,
 	    return KRB5KDC_ERR_POLICY;
 	}
 
-	if (!is_as_req && !client->flags.client){
+	if(!client->flags.client){
 	    kdc_log(context, config, 0,
-		    "Principal may only act as client in AS-REQ -- %s", client_name);
+		    "Principal may not act as client -- %s", client_name);
 	    return KRB5KDC_ERR_POLICY;
 	}
 
@@ -1056,7 +1056,7 @@ _kdc_as_rep(krb5_context context,
      */
 
     ret = _kdc_db_fetch(context, config, client_princ,
-			HDB_F_GET_ANY | flags, NULL,
+			HDB_F_GET_CLIENT | flags, NULL,
 			&clientdb, &client);
     if(ret == HDB_ERR_NOT_FOUND_HERE) {
 	kdc_log(context, config, 5, "client %s does not have secrets at this KDC, need to proxy", client_name);
-- 
2.11.0


From 9b9097550a6eccb7e2717200b3014d6cc82e8b03 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet at samba.org>
Date: Mon, 27 Aug 2018 15:00:12 +1200
Subject: [PATCH 4/5] selftest: Add new test to run krb5.kdc.canon against a
 user with an SPN for a UPN

The failures in this test compared with Windows Server 1709 are added to
knownfail.

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 selftest/knownfail.d/kdc-spn-is-upn | 16 ++++++++++++++++
 selftest/selftest.pl                |  1 +
 selftest/target/Samba4.pm           | 23 +++++++++++++++++++++++
 source4/selftest/tests.py           |  6 ++++++
 4 files changed, 46 insertions(+)
 create mode 100644 selftest/knownfail.d/kdc-spn-is-upn

diff --git a/selftest/knownfail.d/kdc-spn-is-upn b/selftest/knownfail.d/kdc-spn-is-upn
new file mode 100644
index 00000000000..9225ec215df
--- /dev/null
+++ b/selftest/knownfail.d/kdc-spn-is-upn
@@ -0,0 +1,16 @@
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.normal
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.lc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.uc-user.krb5-realm.no-win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.lc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.lc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
+^samba4.krb5.kdc with account having identical UPN and SPN.canon.no-enterprise.uc-realm.uc-user.krb5-realm.win2k.spn.s4u2self
diff --git a/selftest/selftest.pl b/selftest/selftest.pl
index bd72841199f..8630d7673d1 100755
--- a/selftest/selftest.pl
+++ b/selftest/selftest.pl
@@ -815,6 +815,7 @@ sub get_running_env($)
 my @exported_envvars = (
 	# domain stuff
 	"DOMAIN",
+	"DNSNAME",
 	"REALM",
 	"DOMSID",
 
diff --git a/selftest/target/Samba4.pm b/selftest/target/Samba4.pm
index 00dfd28e9dd..a4585c0fac7 100755
--- a/selftest/target/Samba4.pm
+++ b/selftest/target/Samba4.pm
@@ -747,6 +747,7 @@ nogroup:x:65534:nobody
 		DOMAIN => $ctx->{domain},
 		USERNAME => $ctx->{username},
 		REALM => $ctx->{realm},
+		DNSNAME => $ctx->{dnsname},
 		SAMSID => $ctx->{samsid},
 		PASSWORD => $ctx->{password},
 		LDAPDIR => $ctx->{ldapdir},
@@ -870,6 +871,28 @@ userPrincipalName: testdenied_upn\@$ctx->{realm}.upn
 	$samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
 	$samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
 	$samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
+	    . " user create --configfile=$ctx->{smb_conf} testupnspn $ctx->{password}";
+	unless (system($samba_tool_cmd) == 0) {
+		warn("Unable to add testupnspn user: \n$samba_tool_cmd\n");
+		return undef;
+	}
+
+	my $user_dn = "cn=testupnspn,cn=users,$base_dn";
+	open(LDIF, "|$ldbmodify -H $ctx->{privatedir}/sam.ldb");
+	print LDIF "dn: $user_dn
+changetype: modify
+replace: userPrincipalName
+userPrincipalName: http/testupnspn.$ctx->{dnsname}\@$ctx->{realm}
+replace: servicePrincipalName
+servicePrincipalName: http/testupnspn.$ctx->{dnsname}
+-
+";
+	close(LDIF);
+
+	$samba_tool_cmd = "";
+	$samba_tool_cmd .= "KRB5_CONFIG=\"$ret->{KRB5_CONFIG}\" ";
+	$samba_tool_cmd .= "KRB5CCNAME=\"$ret->{KRB5_CCACHE}\" ";
+	$samba_tool_cmd .= Samba::bindir_path($self, "samba-tool")
 	    . " group addmembers --configfile=$ctx->{smb_conf} 'Allowed RODC Password Replication Group' '$testallowed_account'";
 	unless (system($samba_tool_cmd) == 0) {
 		warn("Unable to add '$testallowed_account' user to 'Allowed RODC Password Replication Group': \n$samba_tool_cmd\n");
diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index f884d272cc7..aec0946166d 100755
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -1067,6 +1067,12 @@ plansmbtorture4testsuite('krb5.kdc', "rodc", ['ncacn_np:$SERVER_IP', "-k", "yes"
 env = "promoted_dc"
 plansmbtorture4testsuite('krb5.kdc', env, ['ncacn_np:$SERVER_IP', "-k", "yes", '-U$USERNAME%$PASSWORD', '--workgroup=$DOMAIN', '--realm=$REALM'],
                          "samba4.krb5.kdc with specified account")
+plansmbtorture4testsuite('krb5.kdc', env, ['ncacn_np:$SERVER_IP', "-k", "yes", '-Utestupnspn%$PASSWORD', '--workgroup=$DOMAIN', '--realm=$REALM',
+                                           '--option=torture:expect_machine_account=true',
+                                           '--option=torture:krb5-upn=http/testupnspn.$DNSNAME@$REALM',
+                                           '--option=torture:krb5-hostname=testupnspn.$DNSNAME',
+                                           '--option=torture:krb5-service=http'],
+                         "samba4.krb5.kdc with account having identical UPN and SPN")
 
 
 for env in ["rodc", "promoted_dc", "fl2000dc", "fl2008r2dc"]:
-- 
2.11.0


From 8e5d355c3936b4c24224d1a7ce30e312b635dc22 Mon Sep 17 00:00:00 2001
From: Andrew Bartlett <abartlet at samba.org>
Date: Mon, 27 Aug 2018 15:01:41 +1200
Subject: [PATCH 5/5] torture: Confirm that this element of the krb5.kdc test
 does not pass against Windows

This should be fixed, but in the meantime add clue to avoid regressions on
bug 11539.

Signed-off-by: Andrew Bartlett <abartlet at samba.org>
---
 source4/torture/krb5/kdc-heimdal.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/source4/torture/krb5/kdc-heimdal.c b/source4/torture/krb5/kdc-heimdal.c
index aa610d33a9f..cc70c9eda67 100644
--- a/source4/torture/krb5/kdc-heimdal.c
+++ b/source4/torture/krb5/kdc-heimdal.c
@@ -174,6 +174,15 @@ static bool torture_check_krb5_error(struct torture_krb5_context *test_context,
 						 rc, 0,
 						 "Got invalid method data");
 
+			/*
+			 * NOTE:
+			 *
+			 * Windows (eg Server 1709) only returns a
+			 * KRB5_PADATA_ETYPE_INFO2 in this situation.
+			 * This test should be fixed but care needs to
+			 * be taken not to reintroduce
+			 * https://bugzilla.samba.org/show_bug.cgi?id=11539
+			 */
 			torture_assert(test_context->tctx,
 				       m.len > 0,
 				       "No PA_DATA given");
-- 
2.11.0