From: Andrew Bartlett <abartlet@samba.org>
Date: Fri, 2 Feb 2024 01:41:52 +0000 (+1300)
Subject: s4-auth/kerberos: Note the good possability that the msDS-KeyVersionNumber is wrong
X-Git-Tag: tdb-1.4.11~1455
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=91c05536108aed369fadff363799726e0b431dc4;p=thirdparty%2Fsamba.git

s4-auth/kerberos: Note the good possability that the msDS-KeyVersionNumber is wrong

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jo Sutton <josutton@catalyst.net.nz>
---

diff --git a/source4/auth/kerberos/srv_keytab.c b/source4/auth/kerberos/srv_keytab.c
index add75bc8df9..899a677bc61 100644
--- a/source4/auth/kerberos/srv_keytab.c
+++ b/source4/auth/kerberos/srv_keytab.c
@@ -316,6 +316,10 @@ NTSTATUS smb_krb5_fill_keytab_gmsa_keys(TALLOC_CTX *mem_ctx,
 
 	cli_credentials_set_username(cred, username, CRED_SPECIFIED);
 
+	/*
+	 * Note that this value may not be correct, it is updated
+	 * after the query that gives us the passwords
+	 */
 	kvno = ldb_msg_find_attr_as_uint(msg, "msDS-KeyVersionNumber", 0);
 
 	cli_credentials_set_kvno(cred, kvno);