MIT KDC: allow Windows expired password change with short realm

Achilleas Stergioulisrequested to merge
Achilleas90/samba:bug-14630-mit-kdc-short-realm-password-change into master

Problem

With the MIT KDC backend, Windows cannot change an expired password when its canonicalizing AS-REQ asks for kadmin/changepw using the NetBIOS domain as the realm. The KDC returns KDC_ERR_KEY_EXPIRED before Windows reaches kpasswd. This is Samba Bugzilla 14630.

Cause

kdb_samba_db_check_policy_as() recomputes whether the request is for password change from the raw request principal and requires its realm to equal the default DNS realm. The preceding KDB lookup already validates the local password-change service and marks its server entry with KRB5_KDB_PWCHANGE_SERVICE.

Fix

Use KRB5_KDB_PWCHANGE_SERVICE from the validated server entry. This permits the expired-password exception only for the local password-change service while retaining preauthentication, password verification, disabled/locked-account checks, password policy, and the MIT KDC ticket restrictions.

Tests

  • Added pwdLastSet=0 and natural-expiry coverage using the Windows short-realm request and observed KDC options.
  • Fedora 44 system MIT krb5 developer build: samba.tests.krb5.kpasswd_tests passed 29/29.
  • Broader kpasswd, AS-REQ, and lockout subset passed 963 tests across six suites.
  • The patched build was also confirmed to restore the affected Windows domain-client password-change workflow.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14630

Checklist

  • All commits are signed off.
  • Functional regression tests added.
  • Related negative KDC, lockout, and password-policy tests pass.
  • Documentation change is not applicable.

Please consider backporting this fix to supported release branches, including 4.24.

Merge request reports