2 files changed, 9 insertions, 0 deletions
diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index 7657b4de..f69245ef 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -1006,6 +1006,12 @@ static void krb5_auth_done(struct tevent_req *subreq)
         ret = EOK;
         goto done;
 
+    case ERR_ACCOUNT_LOCKED:
+        state->pam_status = PAM_PERM_DENIED;
+        state->dp_err = DP_ERR_OK;
+        ret = EOK;
+        goto done;
+
     case ERR_NO_CREDS:
         state->pam_status = PAM_CRED_UNAVAIL;
         state->dp_err = DP_ERR_OK;
diff --git a/src/providers/krb5/krb5_child.c b/src/providers/krb5/krb5_child.c
index c8b8a005..12eb9e20 100644
--- a/src/providers/krb5/krb5_child.c
+++ b/src/providers/krb5/krb5_child.c
@@ -1316,6 +1316,9 @@ static errno_t map_krb5_error(krb5_error_code kerr)
         return ERR_NETWORK_IO;
 
     case KRB5KDC_ERR_CLIENT_REVOKED:
+        return ERR_ACCOUNT_LOCKED;
+
+    case KRB5KDC_ERR_NAME_EXP:
         return ERR_ACCOUNT_EXPIRED;
 
     case KRB5KDC_ERR_KEY_EXP: