From rt-comment at krbdev.mit.edu  Sat Nov  1 02:45:10 2025
From: rt-comment at krbdev.mit.edu (Everyday Engineering via RT)
Date: Sat, 01 Nov 2025 02:45:10 -0400
Subject: [krbdev.mit.edu #9187] Re: Cannot renew ticket using mit kfw 4.1
 (kerberos for windows)
In-Reply-To: <CAHugKjR_vVTZCavbEOOF0xrhh=0=dtkVURkQrozsgu-N43eXrw@mail.gmail.com>
References: <RT-Ticket-9187@mit.edu>
 <CAHugKjQ4wKw96cfevH2emFtKU-_tR=nOBF+M4k0xUH9zYCJ95Q@mail.gmail.com>
 <CAHugKjR_vVTZCavbEOOF0xrhh=0=dtkVURkQrozsgu-N43eXrw@mail.gmail.com>
Message-ID: <rt-4.4.3-2-3803451-1761979510-1880.9187-4-0@mit.edu>


Sat Nov 01 02:45:10 2025: Request 9187 was acted upon.
 Transaction: Ticket created by eubnara at gmail.com
       Queue: krb5
     Subject: Re: Cannot renew ticket using mit kfw 4.1 (kerberos for windows)
       Owner: Nobody
  Requestors: eubnara at gmail.com
      Status: new
 Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9187 >


I rebuild mit kfw 4.1 with the latest code (
https://github.com/krb5/krb5/commit/0415c857d320347bbd7ab33bde677b977387d940,
commit 0415c85) and I can renew kerberos tickets inside FILE credential
cache on mit kfw 4.1.
I uploaded msi installer on
https://github.com/eubnara/krb5/releases/tag/20251030 release.
I suggest that mit kfw 4.1 official version should also be updated with the
latest krb5 codes on https://web.mit.edu/kerberos/dist/.

cf.

In the MIT KfW build based on commit 0415c85, if a ticket is already
issued, clicking the *"Get Ticket"* button fails to obtain a new one. You
need to either *"Destroy Ticket"* first and then *"Get Ticket"* again, or
use *"Renew Ticket"* instead.
In the official mit kfw 4.1, clicking *"Get Ticket"* would overwrite the
existing ticket even if one was already issued.
I suspect that PR #218 <https://github.com/krb5/krb5/pull/218> might have
influenced this behavior, but I haven?t fully confirmed it yet.

2025? 10? 30? (?) ?? 1:55, Everyday Engineering <eubnara at gmail.com>?? ??:

> Hello, this is the first time to send an email to krb5-bugs. I hope this
> is the right way.
>
> I use mit kfw 4.1 on windows 11.
> I can renew kerberos ticket which is stored at "MSLSA:".
> However, I cannot renew the ticket which is stored at "FILE:".
> I can renew it with the command "kinit -R".
>
> Of course, automatic renewal also doesn't work.
>
> It is hard for me to find the cause from the kfw source codes.
>
> Could I get some any help?
>
> Regards.
>


From rt-comment at krbdev.mit.edu  Sat Nov  1 02:52:23 2025
From: rt-comment at krbdev.mit.edu (Greg Hudson via RT)
Date: Sat, 01 Nov 2025 02:52:23 -0400
Subject: [krbdev.mit.edu #9187] [Comment] Replacing FILE ccache fails on
 Windows
In-Reply-To: <CAHugKjR_vVTZCavbEOOF0xrhh=0=dtkVURkQrozsgu-N43eXrw@mail.gmail.com>
References: <RT-Ticket-9187@mit.edu>
 <CAHugKjQ4wKw96cfevH2emFtKU-_tR=nOBF+M4k0xUH9zYCJ95Q@mail.gmail.com>
 <CAHugKjR_vVTZCavbEOOF0xrhh=0=dtkVURkQrozsgu-N43eXrw@mail.gmail.com>
Message-ID: <rt-4.4.3-2-3800337-1761979943-1410.9187-8-0@mit.edu>


https://krbdev.mit.edu/rt/Ticket/Display.html?id=9187
This is a comment.  It is not sent to the Requestor(s):

The submitter filed https://github.com/krb5/krb5/pull/1467 with a candidate
fix.  I've made some comments there, but to summarize the problem here, I
believe there is a Windows regression in
commit 371f09d4bf4ca0c7ba15c5ef909bc35307ed9cc3 (ticket 7707), caused by
fcc_replace() assuming POSIX rename() semantics.