The krb5_get_credentials() rewrite for IAKERB accidentally omitted the
final step of restoring the requested realm in the output credentials.
As a result, referral entries are not cached, and the caller sees the
actual realm in (*out_creds)->server instead of the referral realm as
before.  Fix this in complete() by swapping ctx->req_server into
ctx->reply_creds->server.

https://github.com/krb5/krb5/commit/9d798967caaea110173d683af2948ed6bf57ce97
Commit By: ghudson
Revision: 24945
Changed Files:
U   trunk/src/lib/krb5/krb/get_creds.c