[11836] in Kerberos-V5-bugs
[krbdev.mit.edu #6838] Regression in renewable handling
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Tue Dec 14 12:26:13 2010
Mail-followup-to: rt@krbdev.mit.edu
mail-copies-to: never
From: "Greg Hudson via RT" <rt-comment@krbdev.MIT.EDU>
In-Reply-To: <rt-6838@krbdev.mit.edu>
Message-ID: <rt-6838-33613.8.26807386662168@krbdev.mit.edu>
To: "'AdminCc of krbdev.mit.edu Ticket #6838'":;"'AdminCc of krbdev.mit.edu Ticket #6838'":;@MIT.EDU
Date: Tue, 14 Dec 2010 12:26:10 -0500 (EST)
Reply-To: rt-comment@krbdev.MIT.EDU
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
There are two things going on here.
First, in 1.9, when we renew a ticket, we don't fold in KDC options from
the old ticket, as we did in the past. So we ask for a renewed but non-
renewable ticket.
Second, when you ask the KDC (any version) for a renewed but non-
renewable ticket, it begins by copying the header ticket into the
response ticket, including TKT_FLG_RENEWABLE. But the code to calculate
enc_tkt_reply.times.renew_till is conditional on KDC_OPT_RENEWABLE being
set in the request, so that never happens and renew_till is left at 0.
So you wind up with a renewable ticket with a renewable life of 0, which
is weird.
I will fix the client regression as part of this ticket.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
