[2249] in Kerberos
krb_get_pw_in_tkt won't return long-life tickets
daemon@ATHENA.MIT.EDU (Peter Lister, Cranfield Computer C)
Fri Oct 2 11:27:19 1992
To: kerberos@Athena.MIT.EDU, info-afs-kerberos@transarc.com
Cc: ccprl@xdm001.ccc.cranfield.ac.uk
Date: Fri, 02 Oct 92 15:45:36 BST
From: "Peter Lister, Cranfield Computer Centre" <ccprl@xdm001.ccc.cranfield.ac.uk>
My program uses (DECathena) krb_get_pw_in_tkt to get a long-duration
ticket for an AFS token. (AFS should treat a lifetime of 0xff as
"infinite", and 0xbf as 30 days, probably as much as anyone here
needs). However, when I call krb_get_pw_in_tkt with a lifetime of
greater than 0x7f, the returned ticket's lifetime is 0xff (according to
krb_get_cred) and the expiry date of the ticket in the ticket file is -
5 minutes. 0x7f or less is fine, getting me 10 hours or so.
Presumably the char value of the lifetime is converted to signed int at
some point, the "sign bit" propagated to the top 3 bytes and then
"rounded down" to 255. 255 is then interpreted as -1, and I get a
ticket expired 5 mins before it's issued.
Question: is this a known problem in MIT kerberos, AFS kerberos or DECathena?
If so, is there any easy way round it? Using MIT's kerberos kit is not
feasible, due to US export restrictions.
Peter Lister p.lister@cranfield.ac.uk
Computer Centre,
Cranfield Institute of Technology, Voice: +44 234 750111 ext 3157
Cranfield, Bedfordshire MK43 0AL England Fax: +44 234 750875
