[krbdev.mit.edu #6838] Regression in renewable handling

Greg Hudson via RT rt-comment at krbdev.mit.edu
Tue Dec 14 12:26:10 EST 2010


There are two things going on here.

First, in 1.9, when we renew a ticket, we don't fold in KDC options from 
the old ticket, as we did in the past.  So we ask for a renewed but non-
renewable ticket.

Second, when you ask the KDC (any version) for a renewed but non-
renewable ticket, it begins by copying the header ticket into the 
response ticket, including TKT_FLG_RENEWABLE.  But the code to calculate 
enc_tkt_reply.times.renew_till is conditional on KDC_OPT_RENEWABLE being 
set in the request, so that never happens and renew_till is left at 0.  
So you wind up with a renewable ticket with a renewable life of 0, which 
is weird.

I will fix the client regression as part of this ticket.



More information about the krb5-bugs mailing list