Permit the realm to be canonicalized from any realm to the anonymous

realm when anonymous is requested even when the principal is not a TGS
principal.

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/anonymous@23505 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/get_in_tkt.c b/src/lib/krb5/krb/get_in_tkt.c
index 95f952aace885912703ff3f632d2883dd2e14cda..7043845920227afa433172523ba9107f52098b08 100644 (file)
--- a/src/lib/krb5/krb/get_in_tkt.c
+++ b/src/lib/krb5/krb/get_in_tkt.c
@@ -310,6 +310,9 @@ verify_as_reply(krb5_context            context,
     if (canon_req) {
         canon_ok = IS_TGS_PRINC(context, request->server) &&
             IS_TGS_PRINC(context, as_reply->enc_part2->server);
+        if ((!canon_ok ) && (request->kdc_options &KDC_OPT_REQUEST_ANONYMOUS))
+            canon_ok = krb5_principal_compare(context, as_reply->client,
+                                              krb5_anonymous_principal());
     } else
         canon_ok = 0;