Xcreds (7130) Does not deal well when the endpoint has an Entra ID Cloud Kerberos Ticket

[miawri]

If PSSO with Secure Enclave is enabled, macOS receives a @KERBEROS.MICROSOFTONLINE.COM kerberos ticket.

This seems to affect any AD based kerberos ticket from being processed correctly by XCreds as the "AD Password Expires" is not populated when this cloud ticket is present.

Destroying the cloud ticket and re-running XCreds allows that field to be populated.

[davelebbing]

@twocanoes can you confirm if this is milestone XCreds 5 vs future? I will need some testing guidance for this.

[twocanoes]

@davelebbing we need to set up a MS PSSO environment to test, but i have had others report similar issues and we should be interoperable with PSSO.