(hdb_unseal_key_mkey): try to unseal key with keyusage 0 in case the

key was encrypted with MIT Kerberos (old patch from Johan)


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@15826 ec53bebd-3082-4978-b11e-865c3cabbd6b

lib/hdb/mkey.c

@@ -393,6 +393,13 @@ hdb_unseal_key_mkey(krb5_context context, Key *k, hdb_master_key mkey)
 		       k->key.keyvalue.data,
 		       k->key.keyvalue.length,
 		       &res);
+    if(ret == KRB5KRB_AP_ERR_BAD_INTEGRITY) {
+	/* try to decrypt with MIT key usage */
+	ret = krb5_decrypt(context, key->crypto, 0,
+			   k->key.keyvalue.data,
+			   k->key.keyvalue.length,
+			   &res);
+    }    
     if (ret)
 	return ret;