heimdal: Only indicate successful authentication after successful authz

This is needed to match Windows behaviour for NTLM logins.

Andrew Bartlett

Change-Id: I142de19b480cd6499d6f7f025f655e220558d54c
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source4/heimdal/kdc/kerberos5.c b/source4/heimdal/kdc/kerberos5.c
index 939d1b014234630848baf34413b222062a594e9a..bab4b8ca5429a5744a731e6d6dfe99c05e5965e9 100644 (file)
--- a/source4/heimdal/kdc/kerberos5.c
+++ b/source4/heimdal/kdc/kerberos5.c
@@ -1448,10 +1448,6 @@ _kdc_as_rep(krb5_context context,
        goto out;
     }
 
-    if (clientdb->hdb_auth_status)
-       (clientdb->hdb_auth_status)(context, clientdb, client,
-                                   HDB_AUTH_SUCCESS);
-
     /*
      * Verify flags after the user been required to prove its identity
      * with in a preauth mech.
@@ -1463,6 +1459,10 @@ _kdc_as_rep(krb5_context context,
     if(ret)
        goto out;
 
+    if (clientdb->hdb_auth_status)
+       (clientdb->hdb_auth_status)(context, clientdb, client,
+                                   HDB_AUTH_SUCCESS);
+
     /*
      * Selelct the best encryption type for the KDC with out regard to
      * the client since the client never needs to read that data.