r10191: Return the right error code in the case of a time skew. Windows will now

ignore Kerberos and fallback to NTLMSSP when joining. Thanks to Andrew Bartlett
for the assistence.

diff --git a/source/heimdal/kdc/kerberos5.c b/source/heimdal/kdc/kerberos5.c
index 38444f4a13f89be647275212c00d0aa67097047d..2cbb5831d4960c73e839c425326bb826bc81d5f9 100644 (file)
--- a/source/heimdal/kdc/kerberos5.c
+++ b/source/heimdal/kdc/kerberos5.c
@@ -982,7 +982,7 @@ _kdc_as_rep(krb5_context context,
            }
            free_PA_ENC_TS_ENC(&p);
            if (abs(kdc_time - p.patimestamp) > context->max_skew) {
-               ret = KRB5KDC_ERR_PREAUTH_FAILED;
+               ret = KRB5KRB_AP_ERR_SKEW;
                e_text = "Too large time skew";
                kdc_log(context, config, 0,
                        "Too large time skew -- %s", client_name);