ProcessCredSpecFile() makes call to get_machine_krb_ticket() when running in Domainless mode

ProcessCredSpecFile() should have logic like this:

if ( aws_sm_secret_name.length() != 0 )
{
status = get_user_krb_ticket( krb_ticket_info->domain_name,
aws_sm_secret_name, cf_logger );
krb_ticket_info->domainless_user =
"awsdomainlessusersecret:"+aws_sm_secret_name;

if ( status < 0 )
{
cf_logger.logger( LOG_ERR, "Error %d: Cannot get usr krb ticket",
status );
delete krb_ticket_info;
return EXIT_FAILURE;
}
}
else
{
// invoke to get machine ticket
status = get_machine_krb_ticket( krb_ticket_info->domain_name, cf_logger );
if ( status < 0 )
{
cf_logger.logger( LOG_ERR, "Error %d: Cannot get machine krb ticket",
status );
delete krb_ticket_info;
return EXIT_FAILURE;
}
}

Start by locating ProcessCredSpecFile() and trace how Domainless mode sets aws_sm_secret_name before the Kerberos ticket call. Confirm that a nonempty secret selects get_user_krb_ticket() while an empty secret selects get_machine_krb_ticket(), with both failure paths retaining their cleanup and error handling.

Written by the indexing model from the issue text.