Race condition on change of expired password?

This looks like a race condition, although I'm not exactly sure what to do
about it.

windlord:~/dvl/pam-krb5> kinit [email protected]
[email protected]'s Password: 
Your password will expire at Wed Dec 21 17:41:10 2011

Changing password
New password: 
Repeat new password: 
Success: Password changed

kinit: Password incorrect
windlord:~/dvl/pam-krb5> kinit [email protected]
[email protected]'s Password: 
windlord:~/dvl/pam-krb5> echo $?
0

As you can see, everything worked fine if I ran kinit again immediately
with the same (new) password, but the reauthentication with the new
password inside get_init_creds_password fails, and the server reports
invalid preauth in the KDC logs.  It looks like either kpasswdd returns
success before the change is fully committed to disk, or there's some sort
of caching going on (possibly at the OS level) that causes the KDC to not
see the change immediately.

Client is Debian 1.5.dfsg.1-3, server is 1.4.0~git20100726.dfsg.1-2 (the
current Debian stable version).  The server is a single master; there are
no slaves involved.

-- 
Russ Allbery ([email protected])             <http://www.eyrie.org/~eagle/>