prefer KDCIssued over ticket authdata

git-svn-id: svn://anonsvn.mit.edu/krb5/users/lhoward/authdata@22678 dc483132-0cff-0310-8789-dd5450dbe970

diff --git a/src/lib/krb5/krb/authdata.c b/src/lib/krb5/krb/authdata.c
index 8b5ef6031dc02d006a7208f4440c47da1e5f6a4c..dc6f009e9db4c9f832769acc61233d39c6daf36c 100644 (file)
--- a/src/lib/krb5/krb/authdata.c
+++ b/src/lib/krb5/krb/authdata.c
@@ -326,7 +326,7 @@ k5_get_kdc_issued_authdata(krb5_context kcontext,
     /*
      * Note: a module must still implement a verify_authdata
      * method, even it is a NOOP that simply records the value
-     8 of kdc_issued_flag.
+     * of the kdc_issued_flag.
      */
     code = krb5_verify_authdata_kdc_issued(kcontext,
                                            ap_req->ticket->enc_part2->session,
@@ -372,15 +372,7 @@ krb5int_authdata_verify(krb5_context kcontext,
         if (module->ftable->import_attributes == NULL)
             continue;
 
-        code = krb5int_find_authdata(kcontext,
-                                     ticket_authdata,
-                                     authen_authdata,
-                                     module->ad_type,
-                                     &authdata);
-        if (code != 0)
-            break;
-
-        if (authdata == NULL && kdc_issued_authdata != NULL) {
+        if (kdc_issued_authdata != NULL) {
             code = krb5int_find_authdata(kcontext,
                                          kdc_issued_authdata,
                                          NULL,
@@ -392,6 +384,16 @@ krb5int_authdata_verify(krb5_context kcontext,
             kdc_issued_flag = TRUE;
         }
 
+        if (authdata == NULL) {
+            code = krb5int_find_authdata(kcontext,
+                                        ticket_authdata,
+                                        authen_authdata,
+                                        module->ad_type,
+                                        &authdata);
+            if (code != 0)
+                break;
+        }
+
         if (authdata == NULL)
             continue;