1d4db34 ipa-kdb: handle empty S4U proxy in allowed_to_delegate

Authored and Committed by abbra a year ago
    ipa-kdb: handle empty S4U proxy in allowed_to_delegate
    
    With krb5 1.20, S4U processing code uses a special case of passing an
    empty S4U proxy to allowed_to_delegate() callback to identify if the
    server cannot get forwardable S4U2Self tickets according to [MS-PAC]
    3.2.5.1.2.
    
    This means we need to ensure NULL proxy is a valid one and return an
    appropriate response to that.
    
    Fixes: https://pagure.io/freeipa/issue/9083
    Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
    Reviewed-By: Julien Rische <jrische@redhat.com>
    Reviewed-By: Rob Crittenden <rcritten@redhat.com>