In krb5_ldap_put_principal, use krb5_get_attributes_mask to determine whether krbLoginFailedCount existed on the entry when it was retrieved. If it didn't exist, don't try to use LDAP_MOD_INCREMENT, and don't assert an old value when not using LDAP_MOD_INCREMENT. Also, create the krbLoginFailedCount attribute when creating new entries. This allows us to use LDAP_MOD_INCREMENT during the first failed login (if the server supports it), avoiding a race condition. https://github.com/krb5/krb5/commit/f795c92a96a2a559fe01fc5906d488167ab6b4b9 Commit By: ghudson Revision: 24002 Changed Files: U trunk/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c