Fix S4U user identification in preauth case

In 1.10, encrypted timestamp became a built-in module instead of a
hardcoded padata handler.  This changed the behavior of
krb5_get_init_creds as invoked by s4u_identify_user such that
KRB5_PREAUTH_FAILED is returned instead of the gak function's error.
(Module failures are not treated as hard errors, while hardcoded
padata handler errors are.)  Accordingly, we should look for
KRB5_PREAUTH_FAILED in s4u_identify_user.

On a less harmful note, the gak function was returning a protocol
error code instead of a com_err code, and the caller was testing for a
different protocol error code (KDC_ERR_PREAUTH_REQUIRED) which could
never be returned by krb5_get_init_creds.  Clean up both of those by
returning KRB5_PREAUTH_FAILED from the gak function and testing for
that alone.

Reported by Michael Morony.

ticket: 7136
target_version: 1.10.2
tags: pullup

1 files changed, 2 insertions, 4 deletions

diff --git a/src/lib/krb5/krb/s4u_creds.c b/src/lib/krb5/krb/s4u_creds.c
index e4cc8a14be..6a1bcc3e84 100644
--- a/src/lib/krb5/krb/s4u_creds.c
+++ b/src/lib/krb5/krb/s4u_creds.c
@@ -48,7 +48,7 @@ krb5_get_as_key_noop(
     void *gak_data)
 {
     /* force a hard error, we don't actually have the key */
-    return KDC_ERR_PREAUTH_FAILED;
+    return KRB5_PREAUTH_FAILED;
 }
 
 static krb5_error_code
@@ -118,9 +118,7 @@ s4u_identify_user(krb5_context context,
                                   NULL, NULL, 0, NULL, opts,
                                   krb5_get_as_key_noop, &userid,
                                   &use_master, NULL);
-    if (code == 0 ||
-        code == KDC_ERR_PREAUTH_REQUIRED ||
-        code == KDC_ERR_PREAUTH_FAILED) {
+    if (code == 0 || code == KRB5_PREAUTH_FAILED) {
         *canon_user = userid.user;
         userid.user = NULL;
         code = 0;