Possible bug in handling of a renewable ok ticket

[Greg Hudson]

On 9/30/26 00:57, William Brown wrote:
> I think its' not correct that this is rejected, since the KDC did respect the "till" time, and opted that renewable tickets are valid, and it's up to the KDC to determine the renewable lifetime given that the client did not request a bound on this value.
RFC 4120 section 2.9.1 says:

    The RENEWABLE-OK option indicates that the client will accept a
    renewable ticket if a ticket with the requested life cannot otherwise
    be provided.  If a ticket with the requested life cannot be provided,
    then the KDC MAY issue a renewable ticket with a renew-till equal to
    the requested endtime.  The value of the renew-till field MAY still
    be adjusted by site-determined limits or limits imposed by the
    individual principal or server.

This could probably be clearer, but my reading agrees with the current 
code: the KDC may respond with renew-till equal to the requested 
endtime, or with renew-till less than the requested endtime because of 
an applicable policy restriction, but it should not make up a longer 
renewable time than the requested endtime.  The missing rtime field is 
not relevant; rtime only applies to RENEWABLE, not RENEWABLE-OK.