Alexander Bokovoy
6c6fc7db61
For a well-known anonymous principal an Anonymous PKINIT method is used which ignores the password set in the principal entry. For these principals any defined user auth type is irrelevant, their use is defined in RFC 6112. This gets confusing when a default user auth type requires a particular authentication method. When AS request for Anonymous PKINIT is used, a TGT would contain no authentication indicator. It means we cannot apply any specific indicator policy and must skip the checks. Fixes: https://pagure.io/freeipa/issue/9165 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Florence Blanc-Renaud <frenaud@redhat.com>