Unable to create renewable ticket when we switched to a 1.12 KDC

[Greg Hudson]

On 08/20/2015 11:45 PM, Benjamin Kaduk wrote:
>>   We recently ran into a problem wherein the tickets for out service could
>> not be renewed. After a lot of digging, we traced the change in behaviour
> 
> Can you say more about the problematic behavior you were experiencing?  My
> understanding is that the commit you link to was not expected to result in
> any noticable decrease in functionality, so it would be helpful to
> understand what actually happened.

I think the issue is that if you do something like:

    kinit -l 1d -r 1d princname

you no longer get a renewable ticket.  Then, when you go to renew the
ticket, you get an error.  Although there's no practical reason (that I
know of) to renew tickets without extending their lifetimes, I could see
this situation arising as an edge case in some kinds of scripts.  I
didn't anticipate that possibility when making the KDC change in 1.12.