diff --git a/daemons/ipa-kdb/ipa_kdb_mspac.c b/daemons/ipa-kdb/ipa_kdb_mspac.c
index 8594309db..daa42e369 100644
--- a/daemons/ipa-kdb/ipa_kdb_mspac.c
+++ b/daemons/ipa-kdb/ipa_kdb_mspac.c
@@ -2005,7 +2005,7 @@ void get_authz_data_types(krb5_context context, krb5_db_entry *entry,
         service_specific = false;
         authz_data_type = authz_data_list[c];
         sep = strchr(authz_data_list[c], ':');
-        if (sep != NULL) {
+        if (sep != NULL && entry != NULL) {
             if (entry->princ == NULL) {
                 krb5_klog_syslog(LOG_ERR, "Missing principal in database "
                                           "entry, no authorization data will " \
diff --git a/daemons/ipa-kdb/tests/ipa_kdb_tests.c b/daemons/ipa-kdb/tests/ipa_kdb_tests.c
index 5bc89e234..3bd6e64f2 100644
--- a/daemons/ipa-kdb/tests/ipa_kdb_tests.c
+++ b/daemons/ipa-kdb/tests/ipa_kdb_tests.c
@@ -404,6 +404,14 @@ void test_get_authz_data_types(void **state)
         get_authz_data_types(test_ctx->krb5_ctx, entry, &with_pac, &with_pad);
         assert_true(with_pad == test_set[c].exp_with_pad);
         assert_true(with_pac == test_set[c].exp_with_pac);
+
+        /* test if global default are returned if there is no server entry */
+        if (test_set[c].authz_data == NULL && test_set[c].princ == NULL) {
+            get_authz_data_types(test_ctx->krb5_ctx, NULL, &with_pac,
+                                                           &with_pad);
+            assert_true(with_pad == test_set[c].exp_with_pad);
+            assert_true(with_pac == test_set[c].exp_with_pac);
+        }
     }
 
     free(ied);