[39630] in Kerberos
Re: KEYRING ccache can hide valid tickets when it contains expired
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Oct 12 02:57:49 2026
Message-ID: <19ed2495-4c38-49a8-b041-bd0a93948195@mit.edu>
Date: Mon, 12 Oct 2026 02:57:16 -0400
MIME-Version: 1.0
To: Ao Shen <sa22@mails.tsinghua.edu.cn>, kerberos@mit.edu
Content-Language: en-US
From: "Greg Hudson" <ghudson@mit.edu>
In-Reply-To: <asui1ivG5JbMTvdy@PieceMoissance>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: kerberos-bounces@mit.edu
> I'm trying to use KEYRING as default ccache and noticed that when there is a
> service ticket expired, `klist` would truncate the list of available tickets
> in my ccache with an error message:
>
> klist: No credentials cache found while retrieving a ticket
Thanks for investigating and reporting this bug. I confirmed that I can
reproduce the error (using kvno on a server principal created with
-maxlife 1m) and filed a PR to fix it:
https://github.com/krb5/krb5/pull/1546
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
