Workaround for idmap_ad with transitive forest trust after CVE-2025-49716 hardening?

Hi all,

I'm looking for advice on a configuration workaround for idmap_ad
failing on a transitive forest trust after the CVE-2025-49716
Windows DC hardening.

Setup:
- RHEL 9.7, samba-4.22.4-20.el9_7
- Domain member joined to DOMAIN-A.COM (security=ADS, idmap=sss)
- Forest transitive trust to DOMAIN-B.NET (idmap=ad, schema_mode=rfc2307)
- Trust shows as "Routed (via DOMAIN-A)" — no direct trust credentials

What works:
- samba-4.21.3-14 on the same machine, same smb.conf — no issues
- NTLM auth succeeds on 4.22 (PAM_AUTH_CRAP returns NT_STATUS_OK)
- Manual "ldapsearch -Y GSSAPI" to DOMAIN-B DCs works via cross-realm Kerberos

What fails on 4.22:
- The idmap_ad Sids2UnixIDs call returns NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
- The DOMAIN-B winbind child log shows:
    cm_connect_netlogon_transport: get_secure_channel_type gave SEC_CHAN_NULL
    for DOMAIN-B, fallback to noauth on NCACN_NP
- After the CVE-2025-49716 hardening, the DCs reject the anonymous
  netlogon, DsGetDCName fails, and idmap_ad can't resolve UIDs
- Users get NT_STATUS_NO_SUCH_USER because SID-to-UID mapping fails

I understand Bug 15876 addressed the DsGetDCName issue for direct
domain members, and that fix is in 4.22.3+. But in my case the trust
is transitive — the machine has no direct secure channel to DOMAIN-B,
so the child always gets SEC_CHAN_NULL.

I also noticed iXsystems recently fixed a related idmap_ad issue
involving inappropriate private krb5.conf generation that broke
cross-realm Kerberos. Could that be relevant here?

Questions:
1. Is there a smb.conf option that would let idmap_ad use the
   machine's Kerberos credentials (cross-realm referral) for the
   LDAP lookup instead of going through the netlogon path?
2. Is there an additional patch beyond Bug 15876 that I should
   be looking at for the transitive trust case?
3. Any other workaround besides staying on 4.21?

Thanks for any pointers.
-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba