heimdal: Match windows and return KRB5KDC_ERR_CLIENT_REVOKED when the account is...

Change-Id: I3c306d1516aa569549f5f024fe1fff2d4f2abefc
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
(cherry picked from Samba commit 580a705b83014e94556b9d5a8877406816e02190)

diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index ad11790b8810dd218d68b22b48f6eed11320690b..027f8dff2933cc8d30d757b140ad4c108b9bc3ba 100644 (file)
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -1487,7 +1487,7 @@ kdc_check_flags(astgs_request_t r, krb5_boolean is_as_req)
        /* check client */
        if (client->flags.locked_out) {
            _kdc_audit_addreason((kdc_request_t)r, "Client is locked out");
-           return KRB5KDC_ERR_POLICY;
+           return KRB5KDC_ERR_CLIENT_REVOKED;
        }
 
        if (client->flags.invalid) {