pull up r22168 from trunk

 ------------------------------------------------------------------------
 r22168 | hartmans | 2009-04-03 01:36:25 -0400 (Fri, 03 Apr 2009) | 8 lines
 Changed paths:
    M /trunk/src/kdc/kdc_authdata.c

 ticket: 6438
 Subject: Handle authdata encrypted in subkey
 target_version: 1.7
 tags: pullup

 RFC 4120 requires that if a subkey is present in the TGS request that
 authorization data be encrypted in the subkey.  Our KDC did not handle
 this correctly.

ticket: 6438
version_fixed: 1.7

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-7@22244 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index 315269c2af3f24b76c3a576c578e43092a362d48..fd2e3ab5b34e6886a06e9cbf8b051aa1ecd1fdd8 100644 (file)
--- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -403,6 +403,13 @@ handle_request_authdata (krb5_context context,
                          KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY,
                          0, &request->authorization_data,
                          &scratch);
+    if (code != 0)
+       code = krb5_c_decrypt(context,
+                             client_key,
+                             KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY,
+                             0, &request->authorization_data,
+                             &scratch);
+
     if (code != 0) {
        free(scratch.data);
        return code;