From 31c514e3b2f40f0ad737db338c283178588b2040 Mon Sep 17 00:00:00 2001
From: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Date: Thu, 26 Mar 2026 12:13:35 +1300
Subject: [PATCH] kdc: Adjust error code mapping

Commit cbe156d9279effd6780fc36b620321e373217863 mapped error code
HX509_CERT_REVOKED to KRB5_KDC_ERR_REVOKED_CERTIFICATE, so check for the latter
instead.
---
 kdc/kerberos5.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kdc/kerberos5.c b/kdc/kerberos5.c
index b80dbf4de..20c87d421 100644
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -536,7 +536,7 @@ pa_pkinit_validate(astgs_request_t r, const PA_DATA *pa)
 
     ret = _kdc_pk_rd_padata(r, pa, &pkp);
     if (ret || pkp == NULL) {
-        if (ret == HX509_CERT_REVOKED) {
+        if (ret == KRB5_KDC_ERR_REVOKED_CERTIFICATE) {
             ret = KRB5_KDC_ERR_CLIENT_NOT_TRUSTED;
         } else {
             ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;