krb5 commit: Fix securid_sam2 preauth for non-default salt

[Greg Hudson]

https://github.com/krb5/krb5/commit/a2339099ad13c84de0843fd04d0ba612fc194a1e
commit a2339099ad13c84de0843fd04d0ba612fc194a1e
Author: Greg Hudson <ghudson at mit.edu>
Date:   Wed Jan 3 12:06:08 2018 -0500

    Fix securid_sam2 preauth for non-default salt
    
    When looking up the client long-term key, look for any salt type, not
    just the default salt type.
    
    ticket: 8629

 src/plugins/preauth/securid_sam2/grail.c    |    3 +--
 src/plugins/preauth/securid_sam2/securid2.c |    3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/src/plugins/preauth/securid_sam2/grail.c b/src/plugins/preauth/securid_sam2/grail.c
index 18d48f9..48b61b0 100644
--- a/src/plugins/preauth/securid_sam2/grail.c
+++ b/src/plugins/preauth/securid_sam2/grail.c
@@ -213,8 +213,7 @@ verify_grail_data(krb5_context context, krb5_db_entry *client,
         return KRB5KDC_ERR_PREAUTH_FAILED;
 
     ret = krb5_dbe_find_enctype(context, client,
-                                sr2->sam_enc_nonce_or_sad.enctype,
-                                KRB5_KDB_SALTTYPE_NORMAL,
+                                sr2->sam_enc_nonce_or_sad.enctype, -1,
                                 sr2->sam_enc_nonce_or_sad.kvno,
                                 &client_key_data);
     if (ret)
diff --git a/src/plugins/preauth/securid_sam2/securid2.c b/src/plugins/preauth/securid_sam2/securid2.c
index ca99ce3..363e17a 100644
--- a/src/plugins/preauth/securid_sam2/securid2.c
+++ b/src/plugins/preauth/securid_sam2/securid2.c
@@ -313,8 +313,7 @@ verify_securid_data_2(krb5_context context, krb5_db_entry *client,
     }
 
     retval = krb5_dbe_find_enctype(context, client,
-                                   sr2->sam_enc_nonce_or_sad.enctype,
-                                   KRB5_KDB_SALTTYPE_NORMAL,
+                                   sr2->sam_enc_nonce_or_sad.enctype, -1,
                                    sr2->sam_enc_nonce_or_sad.kvno,
                                    &client_key_data);
     if (retval) {