[2208] in Kerberos
stupid question regarding expired tickets in ticket cache
daemon@ATHENA.MIT.EDU (Louis A. Mamakos)
Tue Sep 22 11:28:50 1992
To: kerberos@Athena.MIT.EDU
From: "Louis A. Mamakos" <louie@ni.umd.edu>
Date: Tue, 22 Sep 92 11:00:27 -0400
I can't help but feel that I'm missing something, but I can't figure
out what it is. Here's the situation:
- I'm using Transarc's kaserver, and the MIT version 4 kerberos libraries
to build applications. Specifically, I'm building zephyr.
- I get my TGT using the Transarc klog.krb, which stores away a copy in
the file named by KRBTKFILE. This works just fine. Or so it seems.
- The TGT that I've got has a default expiration time of 25 hours; the
MIT kerberos library, when invoked by the application, acquire a
ticket for zephyr.zephyr@REALM. This seems to work ok. The
expiration time for the zephyr ticket is 8 hours. I can now do
authenticated zephyr stuff with no problems. The world is a happy
place.
The problem that I have occurs 8 hours later, when the zephyr ticket
expires. Now, I would expect that since my TGT is still valid, that
the next time I need to authenticate, a new zephyr.zephyr ticket would
be acquired, and all would be well. This doesn't seem to be
happening. If I nuke the KRBTKFILE, get a new TGT, then everything
works ok. But this seems rather a waste of time, since I've already
got a perfectly valid TGT.
So I start tracing with the debugger, and what I find is that when the
ticket cache is being searched for a ticket (given service name,
instance and realm) in src/lib/krb/get_cred.c, there is no check for
an expired ticket, and the expired ticket is returned with no attempt
made to acquire a new ticket.
In mk_req.c, the code goes something like this:
retval = krb_get_cred(service,instance,realm,&cr);
Look for a ticket...
if (retval == RET_NOTKT) {
If one wasn't found, get a new ticket using the TGT, then search the
cache for it again.
if (retval = get_ad_tkt(service,instance,realm,lifetime))
return(retval);
if (retval = krb_get_cred(service,instance,realm,&cr))
return(retval);
}
The problem is that the first krb_get_cred() doesn't fail, since it
found and expired ticket. That's because there's not check for
expiration in the ticket cache code in get_cred.c
The code in question in get_cred.c is:
while ((tf_status = tf_get_cred(c)) == KSUCCESS) {
/* Is this the right ticket? */
if ((strcmp(c->service,service) == 0) &&
(strcmp(c->instance,instance) == 0) &&
(strcmp(c->realm,realm) == 0))
break;
}
Should the if test also check for a non-expired ticket to declare a
match? Am I missing something here.. This seems like a rather obvious
problem, and that makes me wonder if I'm overlooking something rather
fundamental. It seems to me that adding a check for expiration in the
get_cred.c module would solve my problem, but I'm not certain if this
breaks assumptions made elsewhere.
Louis Mamakos
University of Maryland
