Andrew Bartlett

This last comment I think is the different issue that this has strayed into discussing, which is as @josephsutton1 also noticed, the rotation happening on the input buffer changes potentially...

> Hmm, LGTM but look at the test failing with ` kinit: krb5_get_init_creds: Preauth required but no preauth options send by KDC` -- what's that about? > > EDIT: Ah,...

I've looked over the changes in a local clone, and they are OK, as far as I can tell, with the assistance of ``` [diff] colorMoved = default colorMovedWS =...

@jaltman I could do a CI run with it but we have no tests for certificate revocation currently. We hope to extend the python Kerberos testsuite to do that eventually,...

> First, Debian can increase the size of time_t and fix this problem for every software package. However, Debian won't do that for fear of breaking applications that cannot handle...

Your underlying assertions are correct, the negotiated flags don't change that the username and domain strings in the NEGOTIATE packet (which should be ignored) are not Unicode. Samba just parses...

Only by eyeball, but this seems like the right fix. @BGR360 could you make a PR, that will trigger CI etc and make a merge much more likely.

Thanks @nicowilliams for putting the explanation about Samba's strange NOT_FOUND_HERE handling into the code, that will help others understand our strange RODC hook. The code looks pretty good to me...

Yes, Open a Pull Request, that will trigger a CI run and makes it easier to just accept the change. Even better if you can include a tests of course.

Samba maintains a fairly extensive fork here: https://gitlab.com/samba-team/devel/lorikeet-heimdal/-/branches https://gitlab.com/samba-team/devel/lorikeet-heimdal/-/commits/lorikeet-heimdal-202311290849/?ref_type=heads has the current outstanding changes on top of Heimdal's master of 2 months ago. A large re-indent could cause us a...