ipa-kdb: Fix ACL evaluator

Fixes: https://fedorahosted.org/freeipa/ticket/2343

daemons/ipa-kdb/ipa_kdb_delegation.c

@@ -95,7 +95,7 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
                                        krb5_const_principal target)
 {
     struct ipadb_context *ipactx;
-    krb5_error_code kerr = ENOENT;
+    krb5_error_code kerr;
     LDAPMessage *lentry;
     LDAPDerefRes *deref_results;
     LDAPDerefRes *dres;
@@ -126,6 +126,9 @@ static krb5_error_code ipadb_match_acl(krb5_context kcontext,
         goto done;
     }
 
+    /* the default is that we fail */
+    kerr = ENOENT;
+
     while (lentry) {
         /* both client and target must be found in the same ACI */
         client_missing = true;