Always honor desired_name in gss_add_cred()

Remove the conditionalization around the desired_name processing in
gss_add_cred_from(), so that we always honor the requested name.

(cherry picked from commit 6d4eb6eb473c93f0db05409195448364382760a9)

ticket: 8737
version_fixed: 1.15.4

1 files changed, 10 insertions, 0 deletions

diff --git a/src/tests/gssapi/t_add_cred.c b/src/tests/gssapi/t_add_cred.c
index d59fde9..1407e67 100644
--- a/src/tests/gssapi/t_add_cred.c
+++ b/src/tests/gssapi/t_add_cred.c
@@ -48,6 +48,7 @@ main()
     OM_uint32 minor, major;
     gss_cred_id_t cred1;
     gss_cred_usage_t usage;
+    gss_name_t name;
 
     /* Check that we get the expected error if we pass neither an input nor an
      * output cred handle. */
@@ -56,6 +57,15 @@ main()
                          GSS_C_INDEFINITE, NULL, NULL, NULL, NULL);
     assert(major == (GSS_S_CALL_INACCESSIBLE_WRITE | GSS_S_NO_CRED));
 
+    /* Regression test for #8737: make sure that desired_name is honored when
+     * creating a credential by passing in a non-matching name. */
+    name = import_name("p:does/not/match@WRONG_REALM");
+    major = gss_add_cred(&minor, GSS_C_NO_CREDENTIAL, name, &mech_krb5,
+                         GSS_C_INITIATE, GSS_C_INDEFINITE, GSS_C_INDEFINITE,
+                         &cred1, NULL, NULL, NULL);
+    assert(major == GSS_S_CRED_UNAVAIL);
+    gss_release_name(&minor, &name);
+
     /* Create cred1 with a krb5 initiator cred by passing an output handle but
      * no input handle. */
     major = gss_add_cred(&minor, GSS_C_NO_CREDENTIAL, GSS_C_NO_NAME,