HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
index f5b4137c2b8444163d68ac1de923baef706b81e7..d59eb9731bee0261cef6bff3374996d92e43d8e9 100644 (file)
--- a/source4/heimdal/kdc/krb5tgs.c
+++ b/source4/heimdal/kdc/krb5tgs.c
@@ -2144,6 +2144,10 @@ server_lookup:
            goto out;
        }
 
+       if (rk_is_subkey == 0) {
+           auth_data_key = &adtkt.key;
+       }
+
        kdc_log(context, config, 0, "constrained delegation for %s "
                "from %s (%s) to %s", tpn, cpn, dpn, spn);
     }