kadmin and kinit consider local ticket cache when they should not

Harald Barth <[email protected]>
Newsgroups gmane.comp.encryption.kerberos.heimdal.general
Message-ID <20111108.180607.504394901242098424.haba@habanero>
I have an issue with the Heimdal kadmin and kinit utilities. They look
at the local ticket cache and fail when they really IMHO should _not_
bother with the content of the ticket cache in question.

1. Set clock of your computer wrong

2. Kinit to a realm which does not require preauth.

Now you have a valid ticket with some time diff magic in it in your ticket cache

3. Try to use kadmin, preferably to another realm

 -> Kadmin will fail with Clock skew too great
 This is a bug as kadmin should not have anything to do with the local ticket cache
 and the documentation of kadmin does not list KRB5CCNAME or ticket cache usage either.

4. Correct the clock on your computer

  -> Kadmin will still fail until kdestroy 

  -> kinit will fail to get you a NEW ticket, failing to overwrite the
  ticket in the ticket cache with the wrong time that it is supposed
  to replace. This is a bug as it prevents the admin to correct the
  clock of a computer without the $USER on that computer having a clue
  why he can not use kinit any more to get a new ticket.

Is this description understandable enough or should there be more in a
report to [email protected]?

Harald.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.