krb5 commit [krb5-1.13]: Avoid setting AS key when OTP preauth fails

[Tom Yu]

https://github.com/krb5/krb5/commit/c82185d4b62cb943d47f90d93f4e51d0dd184d18
commit c82185d4b62cb943d47f90d93f4e51d0dd184d18
Author: Nathaniel McCallum <npmccallum at redhat.com>
Date:   Thu May 26 16:54:29 2016 -0400

    Avoid setting AS key when OTP preauth fails
    
    In otp_client_process(), call cb->set_as_key() later in the function
    after the OTP request has been created.  The previous position of this
    call caused the AS key to be replaced even when later code in the
    function failed, preventing other preauth mechanisms from retrieving
    the correct AS key.
    
    (cherry picked from commit 0712d0059d72ddeaf1764f8fa173a321e3bc072d)
    
    ticket: 8421
    version_fixed: 1.13.6
    tags: -pullup
    status: resolved

 src/lib/krb5/krb/preauth_otp.c |   10 +++++-----
 1 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/lib/krb5/krb/preauth_otp.c b/src/lib/krb5/krb/preauth_otp.c
index d9ddc8b..3de528b 100644
--- a/src/lib/krb5/krb/preauth_otp.c
+++ b/src/lib/krb5/krb/preauth_otp.c
@@ -1081,11 +1081,6 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata,
     if (as_key == NULL)
         return ENOENT;
 
-    /* Use FAST armor key as response key. */
-    retval = cb->set_as_key(context, rock, as_key);
-    if (retval != 0)
-        return retval;
-
     /* Attempt to get token selection from the responder. */
     pin = empty_data();
     value = empty_data();
@@ -1115,6 +1110,11 @@ otp_client_process(krb5_context context, krb5_clpreauth_moddata moddata,
     if (retval != 0)
         goto error;
 
+    /* Use FAST armor key as response key. */
+    retval = cb->set_as_key(context, rock, as_key);
+    if (retval != 0)
+        goto error;
+
     /* Encode the request into the pa_data output. */
     retval = set_pa_data(req, pa_data_out);
 error: