heimdal/heimdal — pull request #116 by abartlet (2014-12-18 03:21:12+00:00)
Title: Heimdal kdc preauth

While researching a very strange (at first) test failure in Samba when trying to rebase lorikeet-heimdal up to the modern world, I noticed that Heimdal no longer returned KRB5KDC_ERR_PREAUTH_FAILED errors.

This gave the client library KRB5_GET_IN_TKT_LOOP internally when it got KRB5KDC_ERR_PREAUTH_REQUIRED twice in a row.

This adds a potential fix, which should be carefully examined by someone who understands the intended behaviour in the presence of multiple possible PA requests on the AS-REQ.