illumos gate

From ba625be691ef46d487175d8dfb683fd54dce6429 Mon Sep 17 00:00:00 2001
From: schenklklopfer <wolff@wsg-film.de>
Date: Wed, 27 Sep 2017 13:00:02 +0200
Subject: [PATCH] Update smbns_ads.c

removed typo
added additional help
---
 usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c b/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
index 4c574786d5a..13c4f4bbe27 100644
--- a/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
+++ b/usr/src/lib/smbsrv/libsmbns/common/smbns_ads.c
@@ -1862,7 +1862,7 @@ adjoin_table[] = {
     { SMB_ADS_KRB5_PARSE_PRINCIPAL,
         "Failed parsing the user principal name." },
     { SMB_ADS_KRB5_GET_INIT_CREDS_PW,
-        "Failed getting initial credentials.  (Wrong password?)" },
+        "Failed getting initial credentials. (Check your local system time. Wrong password?)" },
     { SMB_ADS_KRB5_CC_INITIALIZE,
         "Failed initializing the credential cache." },
     { SMB_ADS_KRB5_CC_STORE_CRED,

The kerberos library can tell us when "clock skew" is the reason we fail authentication.
It would be better to propagate that error up so we can accurately report the failure.
There's some work in that direction in illumos-nexenta. See:
https://github.com/Nexenta/illumos-nexenta/blob/release-5.0.3/usr/src/lib/gss_mechs/mech_krb5/krb5/krb/get_in_tkt.c
and related commits there and in libsmb_ns.