[35915] in Kerberos
Re: On credential cache separation between service ticket and TGT
daemon@ATHENA.MIT.EDU (Greg Hudson)
Tue Mar 25 11:56:19 2014
Message-ID: <5331A715.4050307@mit.edu>
Date: Tue, 25 Mar 2014 11:56:05 -0400
From: Greg Hudson <ghudson@mit.edu>
MIME-Version: 1.0
To: Arpit Srivastava <arpit.orb@gmail.com>
In-Reply-To: <CAEvOXU43sOSmzuLkbJh88ADjAU=ws_2t4ZjEyo5vDToOf26cbw@mail.gmail.com>
Cc: kerberos <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On 03/25/2014 11:19 AM, Arpit Srivastava wrote:
> I call gss_init_sec_context with say, /time_req = 20 mins. /Every time
> the service ticket hence obtained expires, a new service ticket is
> obtained with 20 mins validity, instead of renewing the one already
> existing in the cache (so, there are two tickets of same SPN but with
> different validity time stamps). I observed that if I pass time_req =
> GSS_C_INDEFINITE, the same ticket is renewed and a new ticket is not
> created. It would be great if you can provide some insights.
To the best of my knowledge, gss_init_sec_context has no support for
renewing service tickets, only getting new ones using a TGT.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos