From: Tom Yu <tlyu@mit.edu>
Date: Fri, 8 Jan 2010 23:43:02 +0000 (+0000)
Subject: pull up r23603 from trunk
X-Git-Tag: krb5-1.8-beta1~34
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a4281be212e34f85b1acc86f1b9126cbe9f06a5;p=thirdparty%2Fkrb5.git

pull up r23603 from trunk

 ------------------------------------------------------------------------
 r23603 | hartmans | 2010-01-07 13:32:15 -0500 (Thu, 07 Jan 2010) | 7 lines

 subject: Always treat anonymous as preauth required
 ticket: 6623
 target_version: 1.8
 tags: pullup

 Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication.  The anonymous draft depends on a pre-auth exchange to invoke pkinit.

ticket: 6623
version_fixed: 1.8
status: resolved

git-svn-id: svn://anonsvn.mit.edu/krb5/branches/krb5-1-8@23616 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/kdc/do_as_req.c b/src/kdc/do_as_req.c
index 55493ba779..83d3101b64 100644
--- a/src/kdc/do_as_req.c
+++ b/src/kdc/do_as_req.c
@@ -407,6 +407,7 @@ process_as_req(krb5_kdc_req *request, krb5_data *req_pkt,
             goto errout;
         }
         enc_tkt_reply.client = request->client;
+        setflag(client.attributes, KRB5_KDB_REQUIRES_PRE_AUTH);
     }
     /*
      * Check the preauthentication if it is there.