Pass client flag to KDB for client preauth match In the kdcpreauth match_client() callback, if it is necessary to look up the given principal in the KDB, pass KRB5_KDB_FLAG_CLIENT to krb5_db_get_principal(). Samba requires this flag to properly handle enterprise client principals. https://github.com/krb5/krb5/commit/d4359c66c78a2c59e6bf3b905c4de58e920c7349 Author: Greg Hudson Commit: d4359c66c78a2c59e6bf3b905c4de58e920c7349 Branch: master src/kdc/kdc_preauth.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)