From 6b60f4c08d811e4bc3a68d1a4770c2ce5619c890 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Wed, 1 Nov 2017 17:14:05 +0100
Subject: [PATCH 06/23] Handle kvno increment for RODCs

Since the actual password change does not happen on the read-only domain
controller (RODC) the kvno change has to be replicated back which might
take some time. So we check the kvno before and after the change if we
are connected to a RODC and increment the kvno if needed.
---
 library/adenroll.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/library/adenroll.c b/library/adenroll.c
index 05885d0..bb970d1 100644
--- a/library/adenroll.c
+++ b/library/adenroll.c
@@ -1633,8 +1633,30 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
 		             adcli_enroll_flags flags)
 {
 	adcli_result res;
+	krb5_kvno old_kvno = -1;
 
 	if (!(flags & ADCLI_ENROLL_PASSWORD_VALID)) {
+
+		/* Handle kvno changes for read-only domain controllers
+		 * (RODC). Since the actual password change does not happen on
+		 * the RODC the kvno change has to be replicated back which
+		 * might take some time. So we check the kvno before and after
+		 * the change if we are connected to a RODC and increment the
+		 * kvno if needed. */
+		if (!adcli_conn_is_writeable (enroll->conn)) {
+			if (enroll->computer_attributes == NULL) {
+				res = retrieve_computer_account (enroll);
+				if (res != ADCLI_SUCCESS)
+					return res;
+			}
+			old_kvno = adcli_enroll_get_kvno (enroll);
+			_adcli_info ("Found old kvno '%d'", old_kvno);
+
+			ldap_msgfree (enroll->computer_attributes);
+			enroll->computer_attributes = NULL;
+			adcli_enroll_set_kvno (enroll, 0);
+		}
+
 		res = set_computer_password (enroll);
 		if (res != ADCLI_SUCCESS)
 			return res;
@@ -1651,6 +1673,15 @@ enroll_join_or_update_tasks (adcli_enroll *enroll,
 			return res;
 	}
 
+	/* Handle kvno changes for read-only domain controllers (RODC) */
+	if (!adcli_conn_is_writeable (enroll->conn) && old_kvno != -1 &&
+	    adcli_enroll_get_kvno (enroll) != 0 &&
+	    adcli_enroll_get_kvno (enroll) == old_kvno) {
+		enroll->kvno++;
+		_adcli_info ("No kvno change detected on read-only DC,  kvno "
+		             "will be incremented by 1 to '%d'", enroll->kvno);
+	}
+
 	/* We ignore failures of setting these fields */
 	update_and_calculate_enctypes (enroll);
 	update_computer_account (enroll);
-- 
2.14.4