Resolve verifier cred in accept_sec_context

If the verifier cred handle is of type GSS_C_BOTH, we need to resolve
the initiator part of it in order to create a s4u2proxy delegated
credential handle.  (If it's of type GSS_C_ACCEPT, kg_resolve_cred
won't do anything beyond locking and validating the credential.)

ticket: 7356

1 files changed, 3 insertions, 2 deletions

diff --git a/src/lib/gssapi/krb5/accept_sec_context.c b/src/lib/gssapi/krb5/accept_sec_context.c
index 957f86031..975df14aa 100644
--- a/src/lib/gssapi/krb5/accept_sec_context.c
+++ b/src/lib/gssapi/krb5/accept_sec_context.c
@@ -514,13 +514,14 @@ kg_accept_krb5(minor_status, context_handle,
             goto fail;
         }
     } else {
-        major_status = krb5_gss_validate_cred(minor_status,
-                                              verifier_cred_handle);
+        major_status = kg_cred_resolve(minor_status, context,
+                                       verifier_cred_handle, GSS_C_NO_NAME);
         if (GSS_ERROR(major_status)) {
             code = *minor_status;
             goto fail;
         }
         cred_handle = verifier_cred_handle;
+        k5_mutex_unlock(&((krb5_gss_cred_id_t)cred_handle)->lock);
     }
 
     cred = (krb5_gss_cred_id_t) cred_handle;