Fix transited handling for GSSAPI acceptors The Acceptor Names project (#6855) extended krb5_rd_req so that it can accept a "matching principal" in the server parameter. If the matching principal has an empty realm, rd_req_decoded_opt attempted to do transited checking with an empty server realm. To fix this, always reset server to req->ticket->server for future processing steps if we decrypt the ticket using a keytab. decrypt_ticket replaces req->ticket->server with the principal name from the keytab entry, so we know this name is correct. Based on a bug report and patch from nalin@redhat.com. (cherry picked from commit 57acee11b5c6682a7f4f036e35d8b2fc9292875e) [tlyu@mit.edu: removed test due to k5test.py incompatibility] https://github.com/krb5/krb5/commit/ea26f5230c4adaaf48b2d5d3175c2ef05f3b041d Author: Tom Yu Commit: ea26f5230c4adaaf48b2d5d3175c2ef05f3b041d Branch: krb5-1.10 src/lib/krb5/krb/rd_req_dec.c | 8 +++++--- 1 files changed, 5 insertions(+), 3 deletions(-)