HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>

diff --git a/third_party/heimdal/kdc/mssfu.c b/third_party/heimdal/kdc/mssfu.c
index fda5a37b1c6e61d9984b1bf0ae5e64ddabcb7f58..714190fdde10930c901c6db4787b982b831970d9 100644 (file)
--- a/third_party/heimdal/kdc/mssfu.c
+++ b/third_party/heimdal/kdc/mssfu.c
@@ -513,6 +513,15 @@ validate_constrained_delegation(astgs_request_t r)
            goto out;
     }
 
+    if (b->enc_authorization_data && r->rk_is_subkey == 0) {
+       krb5_free_keyblock_contents(r->context, &r->enc_ad_key);
+       ret = krb5_copy_keyblock_contents(r->context,
+                                         &evidence_tkt.key,
+                                         &r->enc_ad_key);
+       if (ret)
+           goto out;
+    }
+
     kdc_log(r->context, r->config, 4, "constrained delegation for %s "
            "from %s (%s) to %s", s4ucname, r->cname, s4usname, r->sname);