Fix S4U user identification in preauth case In 1.10, encrypted timestamp became a built-in module instead of a hardcoded padata handler. This changed the behavior of krb5_get_init_creds as invoked by s4u_identify_user such that KRB5_PREAUTH_FAILED is returned instead of the gak function's error. (Module failures are not treated as hard errors, while hardcoded padata handler errors are.) Accordingly, we should look for KRB5_PREAUTH_FAILED in s4u_identify_user. On a less harmful note, the gak function was returning a protocol error code instead of a com_err code, and the caller was testing for a different protocol error code (KDC_ERR_PREAUTH_REQUIRED) which could never be returned by krb5_get_init_creds. Clean up both of those by returning KRB5_PREAUTH_FAILED from the gak function and testing for that alone. Reported by Michael Morony. https://github.com/krb5/krb5/commit/33a64a7f9dc7342880f7a477a8b3447891d20af5 Author: Greg Hudson Commit: 33a64a7f9dc7342880f7a477a8b3447891d20af5 Branch: master src/lib/krb5/krb/s4u_creds.c | 6 ++---- 1 files changed, 2 insertions(+), 4 deletions(-)