diff options
| -rw-r--r-- | source3/libads/kerberos_verify.c | 12 |
1 files changed, 5 insertions, 7 deletions
diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c index cff007db47..3aa0860809 100644 --- a/source3/libads/kerberos_verify.c +++ b/source3/libads/kerberos_verify.c @@ -376,15 +376,13 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx, goto out; } - /* always check secrets first in order to prevent hitting the - keytab until really necessary */ - - auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ, - ticket, &packet, &tkt, &keyblock); - - if (!auth_ok && lp_use_kerberos_keytab()) { + if (lp_use_kerberos_keytab()) { auth_ok = ads_keytab_verify_ticket(context, auth_context, ticket, &packet, &tkt, &keyblock); } + if (!auth_ok) { + auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ, + ticket, &packet, &tkt, &keyblock); + } release_server_mutex(); got_replay_mutex = False; |