[krbdev.mit.edu #6838] Regression in renewable handling 
    Greg Hudson via RT 
    rt-comment at krbdev.mit.edu
       
    Tue Dec 14 12:26:10 EST 2010
    
    
  
There are two things going on here.
First, in 1.9, when we renew a ticket, we don't fold in KDC options from 
the old ticket, as we did in the past.  So we ask for a renewed but non-
renewable ticket.
Second, when you ask the KDC (any version) for a renewed but non-
renewable ticket, it begins by copying the header ticket into the 
response ticket, including TKT_FLG_RENEWABLE.  But the code to calculate 
enc_tkt_reply.times.renew_till is conditional on KDC_OPT_RENEWABLE being 
set in the request, so that never happens and renew_till is left at 0.  
So you wind up with a renewable ticket with a renewable life of 0, which 
is weird.
I will fix the client regression as part of this ticket.
    
    
More information about the krb5-bugs
mailing list