[krbdev.mit.edu #6838] Regression in renewable handling
Greg Hudson via RT
rt-comment at krbdev.mit.edu
Tue Dec 14 12:26:10 EST 2010
There are two things going on here.
First, in 1.9, when we renew a ticket, we don't fold in KDC options from
the old ticket, as we did in the past. So we ask for a renewed but non-
renewable ticket.
Second, when you ask the KDC (any version) for a renewed but non-
renewable ticket, it begins by copying the header ticket into the
response ticket, including TKT_FLG_RENEWABLE. But the code to calculate
enc_tkt_reply.times.renew_till is conditional on KDC_OPT_RENEWABLE being
set in the request, so that never happens and renew_till is left at 0.
So you wind up with a renewable ticket with a renewable life of 0, which
is weird.
I will fix the client regression as part of this ticket.
More information about the krb5-bugs
mailing list