From dcc5724ed757ced4c84900ae4589425c5c384b1d Mon Sep 17 00:00:00 2001 From: Jo Sutton Date: Tue, 16 Apr 2024 13:58:15 +1200 Subject: [PATCH] s4:dsdb: Add a note that administrators should not set the clock too far in the future Signed-off-by: Jo Sutton Reviewed-by: Andrew Bartlett --- source4/dsdb/gmsa/util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/source4/dsdb/gmsa/util.c b/source4/dsdb/gmsa/util.c index 30ea532f709..a6abaf62c41 100644 --- a/source4/dsdb/gmsa/util.c +++ b/source4/dsdb/gmsa/util.c @@ -1180,6 +1180,12 @@ int gmsa_recalculate_managed_pwd(TALLOC_CTX *mem_ctx, * the keys. */ + /* + * Administrators should be careful not to set a DC’s clock too far in + * the future, or a gMSA’s keys may be stuck at that future time and + * stop updating until said time rolls around for real. + */ + current_key_is_valid = pwd_id != NULL && current_time < current_key_expiration_time; if (current_key_is_valid) { -- 2.11.4.GIT