diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/kdc/kdc_util.c | 32 |
1 files changed, 16 insertions, 16 deletions
diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 33614437a..53adfbb91 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -936,25 +936,25 @@ validate_as_request(register krb5_kdc_req *request, krb5_db_entry client, return KDC_ERR_BADOPTION; } - /* The client's password must not be expired, unless the server is - a KRB5_KDC_PWCHANGE_SERVICE. */ - if (client.pw_expiration && client.pw_expiration < kdc_time && - !isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) { - *status = "CLIENT KEY EXPIRED"; + /* The client must not be expired */ + if (client.expiration && client.expiration < kdc_time) { + *status = "CLIENT EXPIRED"; #ifdef KRBCONF_VAGUE_ERRORS return(KRB_ERR_GENERIC); #else - return(KDC_ERR_KEY_EXP); + return(KDC_ERR_NAME_EXP); #endif } - /* The client must not be expired */ - if (client.expiration && client.expiration < kdc_time) { - *status = "CLIENT EXPIRED"; + /* The client's password must not be expired, unless the server is + a KRB5_KDC_PWCHANGE_SERVICE. */ + if (client.pw_expiration && client.pw_expiration < kdc_time && + !isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) { + *status = "CLIENT KEY EXPIRED"; #ifdef KRBCONF_VAGUE_ERRORS return(KRB_ERR_GENERIC); #else - return(KDC_ERR_NAME_EXP); + return(KDC_ERR_KEY_EXP); #endif } @@ -1868,6 +1868,12 @@ validate_s4u2self_request(krb5_kdc_req *request, int errcode; krb5_db_entry server = { 0 }; + /* The client must not be expired */ + if (client->expiration && client->expiration < kdc_time) { + *status = "CLIENT EXPIRED"; + return KDC_ERR_NAME_EXP; + } + /* The client's password must not be expired, unless the server is a KRB5_KDC_PWCHANGE_SERVICE. */ if (client->pw_expiration && client->pw_expiration < kdc_time) { @@ -1875,12 +1881,6 @@ validate_s4u2self_request(krb5_kdc_req *request, return KDC_ERR_KEY_EXP; } - /* The client must not be expired */ - if (client->expiration && client->expiration < kdc_time) { - *status = "CLIENT EXPIRED"; - return KDC_ERR_NAME_EXP; - } - /* * If the client requires password changing, then return an * error; S4U2Self cannot be used to change a password. |