Unable to create renewable ticket when we switched to a 1.12 KDC
Greg Hudson
ghudson at mit.edu
Fri Aug 21 01:08:58 EDT 2015
On 08/20/2015 11:45 PM, Benjamin Kaduk wrote:
>> We recently ran into a problem wherein the tickets for out service could
>> not be renewed. After a lot of digging, we traced the change in behaviour
>
> Can you say more about the problematic behavior you were experiencing? My
> understanding is that the commit you link to was not expected to result in
> any noticable decrease in functionality, so it would be helpful to
> understand what actually happened.
I think the issue is that if you do something like:
kinit -l 1d -r 1d princname
you no longer get a renewable ticket. Then, when you go to renew the
ticket, you get an error. Although there's no practical reason (that I
know of) to renew tickets without extending their lifetimes, I could see
this situation arising as an edge case in some kinds of scripts. I
didn't anticipate that possibility when making the KDC change in 1.12.
More information about the Kerberos
mailing list