From 7f6947ecb4c919e7970337e7bfccae053e19b0b4 Mon Sep 17 00:00:00 2001 From: Sam Hartman Date: Thu, 7 Jan 2010 18:32:15 +0000 Subject: [PATCH] Always treat anonymous as preauth required Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication. The anonymous draft depends on a pre-auth exchange to invoke pkinit. ticket: 6623 target_version: 1.8 tags: pullup git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23603 dc483132-0cff-0310-8789-dd5450dbe970 --- src/kdc/do_as_req.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c index 55493ba77..83d3101b6 100644 --- a/src/kdc/do_as_req.c +++ b/src/kdc/do_as_req.c @@ -407,6 +407,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt, goto errout; } enc_tkt_reply.client = request->client; + setflag(client.attributes, KRB5_KDB_REQUIRES_PRE_AUTH); } /* * Check the preauthentication if it is there. -- 2.26.2