kdc: Check authdata in ticket rather than in request body

This matches Windows behaviour and the RFC6113 specification.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>

kdc/krb5tgs.c

@@ -1199,12 +1199,12 @@ next_kvno:
 	    ret = KRB5KRB_AP_ERR_BAD_INTEGRITY; /* ? */
 	    goto out;
 	}
-
-	ret = validate_fast_ad(r, *auth_data);
-	if (ret)
-	    goto out;
     }
 
+    ret = validate_fast_ad(r, (*ticket)->ticket.authorization_data);
+    if (ret)
+	goto out;
+
     
     /*
      * Check for FAST request