[37192] in Kerberos
Re: Unable to create renewable ticket when we switched to a 1.12 KDC
daemon@ATHENA.MIT.EDU (Greg Hudson)
Fri Aug 21 01:10:04 2015
Message-ID: <55D6B26A.5060003@mit.edu>
Date: Fri, 21 Aug 2015 01:08:58 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Benjamin Kaduk <kaduk@mit.edu>, Ishaan Joshi <ishaan@cloudera.com>
In-Reply-To: <alpine.GSO.1.10.1508202344080.22210@multics.mit.edu>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 08/20/2015 11:45 PM, Benjamin Kaduk wrote:
>> We recently ran into a problem wherein the tickets for out service could
>> not be renewed. After a lot of digging, we traced the change in behaviour
>
> Can you say more about the problematic behavior you were experiencing? My
> understanding is that the commit you link to was not expected to result in
> any noticable decrease in functionality, so it would be helpful to
> understand what actually happened.
I think the issue is that if you do something like:
kinit -l 1d -r 1d princname
you no longer get a renewable ticket. Then, when you go to renew the
ticket, you get an error. Although there's no practical reason (that I
know of) to renew tickets without extending their lifetimes, I could see
this situation arising as an edge case in some kinds of scripts. I
didn't anticipate that possibility when making the KDC change in 1.12.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
