Fixing clock skew

[Nicolas Williams]

On Fri, May 23, 2003 at 06:09:26PM -0400, Ben Creech wrote:
> Yes, this was much easier than using the krb5_error.  For my purposes, I 
> can just compare k5tgt.times.authtime to time(NULL), then fix the system 
> time and get the TGT again if necessary.
> 
> I could instead perform the correction when getting tickets, but I don't 
> think GSSAPI does this, so other kerberized programs might still get 
> screwed up.

I believe it does.  You have to set "kdc_timesync" in the libdefaults.
And you have to be using the v4 layout for ccaches (set "ccache_type =
4" in the libdefaults).

Cheers,

Nico
--