From 45ebb9c7f2bb2052422cf06bec5a4c33987299f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Love=20H=C3=B6rnquist=20=C3=85strand?= Date: Sun, 18 Feb 2007 08:34:36 +0000 Subject: [PATCH] Only check service key for cross realm PACs. git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@20265 ec53bebd-3082-4978-b11e-865c3cabbd6b --- kdc/krb5tgs.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c index 73c149396..70eea0c2f 100644 --- a/kdc/krb5tgs.c +++ b/kdc/krb5tgs.c @@ -1708,19 +1708,23 @@ server_lookup: } /* check PAC if there is one */ - if (!cross_realm) { + { Key *tkey; + krb5_keyblock *tgtkey = NULL; - ret = hdb_enctype2key(context, &krbtgt->entry, - krbtgt_etype, &tkey); - if(ret) { - kdc_log(context, config, 0, - "Failed to find key for krbtgt PAC check"); - goto out; + if (!cross_realm) { + ret = hdb_enctype2key(context, &krbtgt->entry, + krbtgt_etype, &tkey); + if(ret) { + kdc_log(context, config, 0, + "Failed to find key for krbtgt PAC check"); + goto out; + } + tgtkey = &tkey->key; } ret = check_PAC(context, config, client_principal, - client, server, ekey, &tkey->key, + client, server, ekey, tgtkey, tgt, &rspac, &require_signedpath); if (ret) { kdc_log(context, config, 0,