Fixing clock skew
Nicolas.Williams at sun.com
Fri May 23 19:01:47 EDT 2003
On Fri, May 23, 2003 at 06:09:26PM -0400, Ben Creech wrote:
> Yes, this was much easier than using the krb5_error. For my purposes, I
> can just compare k5tgt.times.authtime to time(NULL), then fix the system
> time and get the TGT again if necessary.
> I could instead perform the correction when getting tickets, but I don't
> think GSSAPI does this, so other kerberized programs might still get
> screwed up.
I believe it does. You have to set "kdc_timesync" in the libdefaults.
And you have to be using the v4 layout for ccaches (set "ccache_type =
4" in the libdefaults).
More information about the krbdev