- (djm) [auth-krb5.c] bz#2032 - use local username in krb5_kuserok check

   rather than full client name which may be of form user@REALM;
   patch from Miguel Sanders; ok dtucker@

1 files changed, 2 insertions, 1 deletions

diff --git a/auth-krb5.c b/auth-krb5.c
index 7c83f597f..6c62bdf54 100644
--- a/auth-krb5.c
+++ b/auth-krb5.c
@@ -157,7 +157,8 @@ auth_krb5_password(Authctxt *authctxt, const char *password)
         if (problem)
                 goto out;
 
-        if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user, client)) {
+        if (!krb5_kuserok(authctxt->krb5_ctx, authctxt->krb5_user,
+            authctxt->pw->pw_name)) {
                 problem = -1;
                 goto out;
         }