Re: Expired tickets not renewed

"Roland C. Dowdeswell" <[email protected]> Wed, 9 Aug 2017 15:06:37 -0400

Newsgroups	gmane.comp.encryption.kerberos.heimdal.general
Message-ID	<20170809190636.GA24779@fedora-23-dvm>

On Wed, Aug 09, 2017 at 09:58:04PM +0700, Victor Sudakov wrote:
>

> Now if I destroy the expired ticket by "kdestroy --credential=host/techno..."
> a new ticket is received and gssapi-with-mic is again successful until
> the new tickets expires again.
> 
> I'm beginning to think of a cron job which would destroy hourly all
> the service tickets... all except the TGT.

To bring the conversation back a little to the original point:

It appears that Heimdal 1.5 had incorrect behaviour.  The ccache code
should skip expired credentials when finding service tickets.  This looks
like it was fixed by the following commit:

	commit 0f1ae2d10186afb654df8f50cc78663eb53f27a9
	Author: Nicolas Williams <[email protected]>
	Date:   Fri Aug 2 18:55:36 2013 -0500

	    Use KRB5_TC_MATCH_TIMES when looking for creds

So, if you upgrade, this issue will be resolved.

-- 
    Roland C. Dowdeswell