isflagset
if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE))
if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE))
if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE))
if (isflagset(request->kdc_options, KDC_OPT_POSTDATED)) {
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE_OK) &&
!isflagset(client.attributes, KRB5_KDB_DISALLOW_RENEWABLE) &&
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) {
if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {
if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE))
if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) {
if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_FORWARDED))
if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE))
if (isflagset(request->kdc_options, KDC_OPT_PROXY)) {
if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE))
if (isflagset(request->kdc_options, KDC_OPT_POSTDATED)) {
if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {
if (isflagset(request->kdc_options, KDC_OPT_RENEW)) {
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE_OK) &&
isflagset(header_ticket->enc_part2->flags,
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) {
if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_PRE_AUTH))
if (isflagset(header_ticket->enc_part2->flags, TKT_FLG_HW_AUTH))
if (!isflagset (request->kdc_options, KDC_OPT_DISABLE_TRANSITED_CHECK)) {
&& !isflagset (enc_tkt_reply.flags, TKT_FLG_TRANSIT_POLICY_CHECKED)) {
if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {
!isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
!isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH))
if (isflagset(server->attributes, KRB5_KDB_PWCHANGE_SERVICE) &&
isflagset(enc_tkt_reply->flags, TKT_FLG_PRE_AUTH))
isflagset (client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) ? "" : "no ",
isflagset (client->attributes, KRB5_KDB_REQUIRES_HW_AUTH) ? "" : "no ",
isflagset (enc_tkt_reply->flags, TKT_FLG_PRE_AUTH) ? "" : "no ",
isflagset (enc_tkt_reply->flags, TKT_FLG_HW_AUTH) ? "" : "no ");
if (isflagset(client->attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
!isflagset(enc_tkt_reply->flags, TKT_FLG_PRE_AUTH))
if (isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&
!isflagset(enc_tkt_reply->flags, TKT_FLG_HW_AUTH))
hw_only = isflagset(client->attributes, KRB5_KDB_REQUIRES_HW_AUTH);
if (isflagset(server.attributes, KRB5_KDB_DISALLOW_TGT_BASED)) {
if ((isflagset(request->kdc_options, KDC_OPT_FORWARDED) ||
isflagset(request->kdc_options, KDC_OPT_FORWARDABLE)) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_FORWARDABLE)) {
if ((isflagset(request->kdc_options, KDC_OPT_PROXY) ||
isflagset(request->kdc_options, KDC_OPT_PROXIABLE)) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_PROXIABLE)) {
if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) ||
isflagset(request->kdc_options, KDC_OPT_POSTDATED)) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_MAY_POSTDATE)) {
if (isflagset(request->kdc_options, KDC_OPT_VALIDATE) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_INVALID)) {
if ((isflagset(request->kdc_options, KDC_OPT_RENEW) ||
isflagset(request->kdc_options, KDC_OPT_RENEWABLE)) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_RENEWABLE)) {
if (isflagset(request->kdc_options, KDC_OPT_PROXY) &&
if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&
isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE)) {
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&
isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE)) {
if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&
isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE)) {
if (isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) &&
isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED)) {
if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY) &&
isflagset(server.attributes, KRB5_KDB_DISALLOW_DUP_SKEY)) {
if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {
if (isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {
if (isflagset(request->kdc_options, KDC_OPT_RENEW) &&
if (isflagset(request->kdc_options, KDC_OPT_ENC_TKT_IN_SKEY)) {
if (isflagset(server.attributes, KRB5_KDB_REQUIRES_HW_AUTH) &&
!isflagset(ticket->enc_part2->flags,TKT_FLG_HW_AUTH)) {
if (isflagset(server.attributes, KRB5_KDB_REQUIRES_PRE_AUTH) &&
!isflagset(ticket->enc_part2->flags, TKT_FLG_PRE_AUTH)) {
if (isflagset(apreq->ap_options, AP_OPTS_USE_SESSION_KEY) ||
isflagset(apreq->ap_options, AP_OPTS_MUTUAL_REQUIRED)) {
if (isflagset((*ticket)->enc_part2->flags, TKT_FLG_INVALID)
&& !isflagset(request->kdc_options, KDC_OPT_VALIDATE)) {
!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
if (isflagset(client.attributes, KRB5_KDB_REQUIRES_PWCHANGE) &&
!isflagset(server.attributes, KRB5_KDB_PWCHANGE_SERVICE)) {
if ((isflagset(request->kdc_options, KDC_OPT_ALLOW_POSTDATE) ||
isflagset(request->kdc_options, KDC_OPT_POSTDATED)) &&
(isflagset(client.attributes, KRB5_KDB_DISALLOW_POSTDATED) ||
isflagset(server.attributes, KRB5_KDB_DISALLOW_POSTDATED))) {
if (isflagset(request->kdc_options, KDC_OPT_FORWARDABLE) &&
(isflagset(client.attributes, KRB5_KDB_DISALLOW_FORWARDABLE) ||
isflagset(server.attributes, KRB5_KDB_DISALLOW_FORWARDABLE))) {
if (isflagset(request->kdc_options, KDC_OPT_RENEWABLE) &&
(isflagset(client.attributes, KRB5_KDB_DISALLOW_RENEWABLE) ||
isflagset(server.attributes, KRB5_KDB_DISALLOW_RENEWABLE))) {
if (isflagset(request->kdc_options, KDC_OPT_PROXIABLE) &&
(isflagset(client.attributes, KRB5_KDB_DISALLOW_PROXIABLE) ||
isflagset(server.attributes, KRB5_KDB_DISALLOW_PROXIABLE))) {
if (isflagset(client.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
if (isflagset(server.attributes, KRB5_KDB_DISALLOW_ALL_TIX)) {
if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {
if (isflagset(request->kdc_options, KDC_OPT_FORWARDED)) {