From b6a25f5f016aef39c3b1d7be8b3ecfe021c03c83 Mon Sep 17 00:00:00 2001
From: Joseph Sutton <josephsutton@catalyst.net.nz>
Date: Tue, 23 Nov 2021 20:00:07 +1300
Subject: [PATCH] kdc: Match Windows error code for mismatching sname

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Conflict: remove selftest/knownfail_heimdal_kdc
---
 source4/kdc/db-glue.c          | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index bfde2baf0b5..4c56e6cbadd 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -2564,7 +2564,7 @@ samba_kdc_check_s4u2self(krb5_context context,
 	 */
 	if (!(orig_sid && target_sid && dom_sid_equal(orig_sid, target_sid))) {
 		talloc_free(frame);
-		return KRB5KDC_ERR_BADOPTION;
+		return KRB5KRB_AP_ERR_BADMATCH;
 	}
 
 	talloc_free(frame);
-- 
2.33.0

