s4:kdc: Fail PAC checksum verification if the krbtgt entry has no keys

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/kdc/mit_kdc_irpc.c b/source4/kdc/mit_kdc_irpc.c
index 9e82d6801b725fa13e29c8b7454107344d66ec61..92fb78d56e5d463efd15511c8abba18e5ac0643e 100644 (file)
--- a/source4/kdc/mit_kdc_irpc.c
+++ b/source4/kdc/mit_kdc_irpc.c
@@ -136,6 +136,7 @@ static NTSTATUS netr_samlogon_generic_logon(struct irpc_message *msg,
         */
        skeys = sentry.keys;
 
+       code = EINVAL;
        for (i = 0; i < skeys.len; i++) {
                krb5_keyblock krbtgt_keyblock = skeys.val[i].key;