kerberos: don't get a tgt ticket for inbound creds
@@ -305,6 +305,8 @@ static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
goto cleanup;
}
+ if (fCredentialUse & SECPKG_CRED_OUTBOUND)
+ {
if ((rv = krb5_get_init_creds_opt_alloc(ctx, &gic_opt)))
goto cleanup;
@@ -335,6 +337,7 @@ static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
krb5_get_init_creds_opt_set_out_ccache(ctx, gic_opt, ccache);
krb5_get_init_creds_opt_set_in_ccache(ctx, gic_opt, ccache);
#endif
+ }
krb5_cc_get_full_name(ctx, ccache, &ccache_name);
krb5_kt_get_name(ctx, keytab, keytab_name, PATH_MAX);
@@ -350,6 +353,10 @@ static SECURITY_STATUS SEC_ENTRY kerberos_AcquireCredentialsHandleA(
NULL, &time_rec);
gss_log_status_messages(major, minor);
+ /* No use getting initial creds for inbound creds */
+ if (!(fCredentialUse & SECPKG_CRED_OUTBOUND))
+ goto cleanup;
+
if (!sspi_is_no_creds(major, minor) && time_rec > 0)
goto cleanup;
