--- samba-4.5.12/source4/heimdal/kdc/kerberos5.c.ORIGINAL	2018-01-15 08:20:42.573351961 -0500
+++ samba-4.5.12/source4/heimdal/kdc/kerberos5.c	2018-01-22 05:46:45.268294676 -0500
@@ -1460,11 +1460,7 @@
     if(client->entry.flags.forwardable && server->entry.flags.forwardable)
 	et.flags.forwardable = f.forwardable;
     else if (f.forwardable) {
-	e_text = "Ticket may not be forwardable";
-	ret = KRB5KDC_ERR_POLICY;
-	kdc_log(context, config, 0,
-		"Ticket may not be forwardable -- %s", client_name);
-	goto out;
+	et.flags.forwardable = !f.forwardable;
     }
     if(client->entry.flags.proxiable && server->entry.flags.proxiable)
 	et.flags.proxiable = f.proxiable;