[20575] in Kerberos_V5_Development
Re: Possible bug in handling of a renewable ok ticket
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Sep 30 02:34:04 2026
Message-ID: <d38ea9f8-5901-4967-9b2b-3e574abbae51@mit.edu>
Date: Wed, 30 Sep 2026 02:33:46 -0400
MIME-Version: 1.0
To: William Brown <william@firstyear.id.au>, krbdev@mit.edu
Content-Language: en-US
From: "Greg Hudson" <ghudson@mit.edu>
In-Reply-To: <4E6DF881-D10A-4B36-A19B-569DE7CC19BA@firstyear.id.au>
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: krbdev-bounces@mit.edu
On 9/30/26 00:57, William Brown wrote:
> I think its' not correct that this is rejected, since the KDC did respect the "till" time, and opted that renewable tickets are valid, and it's up to the KDC to determine the renewable lifetime given that the client did not request a bound on this value.
RFC 4120 section 2.9.1 says:
The RENEWABLE-OK option indicates that the client will accept a
renewable ticket if a ticket with the requested life cannot otherwise
be provided. If a ticket with the requested life cannot be provided,
then the KDC MAY issue a renewable ticket with a renew-till equal to
the requested endtime. The value of the renew-till field MAY still
be adjusted by site-determined limits or limits imposed by the
individual principal or server.
This could probably be clearer, but my reading agrees with the current
code: the KDC may respond with renew-till equal to the requested
endtime, or with renew-till less than the requested endtime because of
an applicable policy restriction, but it should not make up a longer
renewable time than the requested endtime. The missing rtime field is
not relevant; rtime only applies to RENEWABLE, not RENEWABLE-OK.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
