kadmin and kinit consider local ticket cache when they should not
Harald Barth <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <20111108.180607.504394901242098424.haba@habanero> |
I have an issue with the Heimdal kadmin and kinit utilities. They look at the local ticket cache and fail when they really IMHO should _not_ bother with the content of the ticket cache in question. 1. Set clock of your computer wrong 2. Kinit to a realm which does not require preauth. Now you have a valid ticket with some time diff magic in it in your ticket cache 3. Try to use kadmin, preferably to another realm -> Kadmin will fail with Clock skew too great This is a bug as kadmin should not have anything to do with the local ticket cache and the documentation of kadmin does not list KRB5CCNAME or ticket cache usage either. 4. Correct the clock on your computer -> Kadmin will still fail until kdestroy -> kinit will fail to get you a NEW ticket, failing to overwrite the ticket in the ticket cache with the wrong time that it is supposed to replace. This is a bug as it prevents the admin to correct the clock of a computer without the $USER on that computer having a clue why he can not use kinit any more to get a new ticket. Is this description understandable enough or should there be more in a report to [email protected]? Harald.