krb5 commit: Don't treat local krbtgt principal as referral

[Greg Hudson]

https://github.com/krb5/krb5/commit/22f00f6b8233fa281e5aad854789bd14abdda91b
commit 22f00f6b8233fa281e5aad854789bd14abdda91b
Author: Greg Hudson <ghudson at mit.edu>
Date:   Wed Aug 28 18:39:55 2013 -0400

    Don't treat local krbtgt principal as referral
    
    If we look up a principal and in the KDB and get back the local TGS
    principal, the KDC should treat this as an alias, not a referral, and
    should therefore issue a ticket for the requested principal rather the
    canonical name.
    
    ticket: 7698

 src/kdc/do_tgs_req.c |   15 +++++++--------
 1 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 6710912..6415e28 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -217,12 +217,14 @@ process_tgs_req(struct server_handle *handle, krb5_data *pkt,
     if (errcode != 0)
         goto cleanup;
     sprinc = server->princ;
-    if (krb5_is_tgs_principal(server->princ)) {
+    is_referral = krb5_is_tgs_principal(server->princ) &&
+        !krb5_principal_compare(kdc_context, tgs_server, server->princ);
+    if (is_referral) {
         /*
-         * We may be issuing an alternate TGT or host referral, in which case
-         * we should use the canonical name in the reply.  XXX We should track
-         * the reply server separately instead of modifying request->server,
-         * but that requires a bunch of code changes.
+         * We may be issuing an alternate TGT or a referral to another realm,
+         * in which case we should use the canonical name in the reply.  XXX We
+         * should track the reply server separately instead of modifying
+         * request->server, but that requires a bunch of code changes.
          */
         krb5_free_principal(kdc_context, request->server);
         request->server = NULL;
@@ -251,9 +253,6 @@ process_tgs_req(struct server_handle *handle, krb5_data *pkt,
     if (!is_local_principal(kdc_active_realm, header_enc_tkt->client))
         setflag(c_flags, KRB5_KDB_FLAG_CROSS_REALM);
 
-    is_referral = krb5_is_tgs_principal(server->princ) &&
-        !krb5_principal_compare(kdc_context, tgs_server, server->princ);
-
     /* Check for protocol transition */
     errcode = kdc_process_s4u2self_req(kdc_active_realm,
                                        request,