I need to port this to a much older release of Samba, and while it
appears to cleanly apply, we have some custom code setting some of the
* this is really a ugly hack, to support using the Netbios Domain
* as realm against windows KDC's, they always return the full
* based on the DNS Name.
flags |= EXTRACT_TICKET_ALLOW_SERVER_MISMATCH;
flags |= EXTRACT_TICKET_ALLOW_CNAME_MISMATCH;
I plan to write some tests in Samba's test framework, which allows
manipulation of the 'wire' packets via the send_to_kdc handler.