From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Thu, 21 Sep 2023 02:13:36 +0000 (+1200)
Subject: s4:auth: Make returning resource groups the last thing we do
X-Git-Tag: tevent-0.16.0~354
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=842f845c8acc2252abe32b04493aa56edd8f66a9;p=thirdparty%2Fsamba.git

s4:auth: Make returning resource groups the last thing we do

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/source4/auth/kerberos/kerberos_pac.c b/source4/auth/kerberos/kerberos_pac.c
index b4783e60b09..1d2ff1df059 100644
--- a/source4/auth/kerberos/kerberos_pac.c
+++ b/source4/auth/kerberos/kerberos_pac.c
@@ -452,16 +452,6 @@ krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
 		}
 	}
 
-	/*
-	 * If we have resource groups and the caller wants them returned, we
-	 * oblige.
-	 */
-	if (resource_groups != NULL &&
-	    info.logon_info.info->resource_groups.groups.count != 0)
-	{
-		*resource_groups = &info.logon_info.info->resource_groups;
-	}
-
 	/*
 	 * Based on the presence of a REQUESTER_SID PAC buffer, ascertain
 	 * whether the ticket is a TGT. This helps the KDC and kpasswd service
@@ -483,6 +473,16 @@ krb5_error_code kerberos_pac_to_user_info_dc(TALLOC_CTX *mem_ctx,
 		user_info_dc_out->ticket_type = TICKET_TYPE_TGT;
 	}
 
+	/*
+	 * If we have resource groups and the caller wants them returned, we
+	 * oblige.
+	 */
+	if (resource_groups != NULL &&
+	    info.logon_info.info->resource_groups.groups.count != 0)
+	{
+		*resource_groups = &info.logon_info.info->resource_groups;
+	}
+
 	*user_info_dc = user_info_dc_out;
 
 	return 0;