[krbdev.mit.edu #5712] Random issue reported by Kevin

[Jeffrey Altman via RT]

Kevin Koch via RT wrote:
> Today I see this behavior on XP:
> 
> Define two identities: one which can be used to connect to Athena and 
> testprinc at SUCHDAMAGE.ORG (password foobarbaz).  Set testprinc to 
> expire in 5 minutes and not be renewable.  Wait for it to expire.
> 
> Open the NIM GUI.  In the basic view, click the Identity column header 
> to sort the real identity to the top of the list.  Close the GUI.
> 
> Open SecureCRT and connect to Athena.  It works.  Disconnect from 
> Athena and close SecureCRT.
> 
> Open the NIM GUI, sort the Badic view identity list so that testprinc 
> is at the top and close the GUI.
> 
> Open SecureCRT and connect to Athena.  I get a GSSAPI error.

You are getting an error with a ticket that is near expiration.
Perhaps your VM clock and the server clock are off by a couple of
minutes and the service ticket is being rejected.  In this case
the ticket appears to be valid to the client according to its
clock and is invalid on the server.

Attach a debugger to SecureCRT.exe and debug the issue.

These descriptions of symptoms do not help anyone because
they can't be used to reproduce the issue.

> Another clue?  The failure when testprinc is at the top of the Basic 
> view identity list does not happen if the GUI is open.

A clue to what?   The only clues are in the code.  Debug the code.