[8052] in Kerberos
Re: 0 seconds initialization (round 2)
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Thu Sep 19 14:59:47 1996
Date: Thu, 19 Sep 1996 14:44:04 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: Christopher Seawood <cseawood@qualcomm.com>
Cc: kerberos@MIT.EDU
In-Reply-To: [8048]
Date: Thu, 19 Sep 1996 11:12:06 -0700 (PDT)
From: Christopher Seawood <cseawood@qualcomm.com>
On Thu, 19 Sep 1996, Barry Jaspan wrote:
> Did you change the max_life of *all* principals in the database, or
> just the user principal you are kiniting as? In particular, did you
> change the max_life of krbtgt/DAUPHIN? If not, that is the problem.
Ok that did it. Just changing the maxlife of krbtgt/DAUPHIN fixes the
problem. Now the question is why isn't the value in the kdc.conf (10
hours) being used? Shouldn't the server's values be set from the kdc.conf
when the realm is created?
The max_life field of kdc.conf only affects principals when they are
*created*; after that, the principal has its own local copy of
max_life that must be modified with modify_principal. I am guessing
that you did not re-create your database after adding the max_life
field to kdc.conf. When the database was created, the default
max_life therefore was used, and the default in beta 7 is (brokenly)
0. As a resut, krbtgt's max_life was 0 until you explicitly changed
it.
max_life is one of the fields I would like to see moved out of
principal records and into policies in a future release. Adding new
fields to policies is not on the agenda for 1.0, however.
Barry
