[PATCH 0/2] MIT KDC: allow Windows expired password change with short realm

[Achilleas Stergioulis]

Hi all,

I’ve been investigating Samba Bug 14630:

https://bugzilla.samba.org/show_bug.cgi?id=14630
https://gitlab.com/samba-team/samba/-/merge_requests/4677

We hit this on a Fedora Samba AD DC using the MIT KDC backend. When a
user’s password has expired, Windows requests kadmin/changepw using
the NetBIOS domain as the realm. Samba returns KDC_ERR_KEY_EXPIRED, so
Windows never gets as far as contacting the password-change service.

The KDB lookup has already recognized the local password-change
service and set KRB5_KDB_PWCHANGE_SERVICE. My patch uses that
validated flag in the AS policy check instead of checking the realm
from the original request again.

Ordinary TGT requests from expired accounts are still rejected.
Preauthentication, incorrect-password handling, disabled and locked
accounts, and password-policy checks are unchanged.

I also added regression tests for both pwdLastSet=0 and natural
password expiry with the Windows-style short-realm request. The
focused samba.tests.krb5.kpasswd_tests suite passes 29/29 with MIT
Kerberos and 29/29 with embedded Heimdal. We have also tested the
patched Fedora build with the original Windows workflow, and the
password change now works.

The remaining GitLab CI failures appear unrelated: LCOV/geninfo
failures after the tests complete, plus existing flaky filesystem and
WINS tests.

I’d appreciate a review from someone familiar with the MIT KDC/KDB
path. In particular, does using KRB5_KDB_PWCHANGE_SERVICE here look
like the right approach?

Thanks,
Achilleas
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-MIT-KDC-recognize-validated-password-change-service.patch
Type: text/x-patch
Size: 2553 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20260914/6bda290c/0001-MIT-KDC-recognize-validated-password-change-service.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-selftest-reproduce-Windows-expired-password-change-with-short-realm.patch
Type: text/x-patch
Size: 5854 bytes
Desc: not available
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20260914/6bda290c/0002-selftest-reproduce-Windows-expired-password-change-with-short-realm.bin>