From: Stefan Metzmacher <metze@samba.org>
Date: Wed, 20 Sep 2017 21:05:09 +0000 (+0200)
Subject: HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use... 
X-Git-Tag: samba-4.6.15~61
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=312bf1c331038059698d14d7026387079a49bb61;p=thirdparty%2Fsamba.git

HEIMDAL:kdc: if we don't have an authenticator subkey for S4U2Proxy we need to use the additional tickets key

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13131

Signed-off-by: Stefan Metzmacher <metze@samba.org>
---

diff --git a/source4/heimdal/kdc/krb5tgs.c b/source4/heimdal/kdc/krb5tgs.c
index f5b4137c2b8..d59eb9731be 100644
--- a/source4/heimdal/kdc/krb5tgs.c
+++ b/source4/heimdal/kdc/krb5tgs.c
@@ -2144,6 +2144,10 @@ server_lookup:
 	    goto out;
 	}
 
+	if (rk_is_subkey == 0) {
+	    auth_data_key = &adtkt.key;
+	}
+
 	kdc_log(context, config, 0, "constrained delegation for %s "
 		"from %s (%s) to %s", tpn, cpn, dpn, spn);
     }