[8091] in Kerberos
Re: 0 seconds initialization (round 2)
daemon@ATHENA.MIT.EDU (Paul Fleming)
Sun Sep 22 23:21:37 1996
To: kerberos@MIT.EDU
Date: Thu, 19 Sep 1996 14:55:52 -0500
From: Paul Fleming <fleminpm@som.siu.edu>
Reply-To: fleminpm@som.siu.edu
Barry Jaspan wrote:
>
> The max_life field of kdc.conf only affects principals when they are
> *created*; after that, the principal has its own local copy of
> max_life that must be modified with modify_principal. I am guessing
> that you did not re-create your database after adding the max_life
> field to kdc.conf. When the database was created, the default
> max_life therefore was used, and the default in beta 7 is (brokenly)
> 0. As a resut, krbtgt's max_life was 0 until you explicitly changed
> it.
>
> max_life is one of the fields I would like to see moved out of
> principal records and into policies in a future release. Adding new
> fields to policies is not on the agenda for 1.0, however.
>
> Barry
I recreated the database after changing the max_life value and still no
luck.
I did some digging (this may be totally off base but it's a shot)
the kadm5_get_config_params function in lib/kadm5/alt_prof.c says that
when called fields to be filled should have there bitmask set.
I looked at the kadmin/dbutil/kadm5_create.c file and nowhere is the
MAX_LIFE mask set before reading the file. kadmin/changpw gets
created OK because the max_life is hardcoded in the source but the
krbtgt principal gets its default lifetime from the parameters
read by kadm5_get_config_params...
Am I on to something or just totally brain fried from looking at this
too long?
---
Paul Fleming
Information Systems Center
Southern Illinois University at Carbondale
fleminpm@som.siu.edu
