Re: kinit only gets addressless tickets

Then your kinit must do something different from mine. Example:

laptop$ kinit --addr -a 10.1.2.3
[email protected]'s Password: 
habook:~$ klist -v
Credentials cache: FILE:/tmp/krb5cc_18118--STACKEN.KTH.SE
        Principal: [email protected]
    Cache version: 4

Server: krbtgt/[email protected]
Client: [email protected]
Ticket etype: aes256-cts-hmac-sha1-96, kvno 1
Ticket length: 421
Auth time:  Sep 21 14:22:49 2018
End time:   Sep 22 00:22:46 2018
Ticket flags: pre-authent, initial, forwardable
Addresses: IPv4:130.229.161.9, IPv6:2001:6b0:1:1041:5ce6:49f7:7fe0:a9e, IPv6:2001:6b0:1:1041:8e70:5aff:fec8:1ef8, IPv4:10.1.2.3

This gives me tickets for the adresses my laptop has at the moment and in addition to that 10.1.2.3. 

New adresses are then put onto the delegated tickets when using openssh to login to a server:

server$ klist -v
Credentials cache: FILE:/tmp/krb5cc_18118_QEiMlMJMDe
        Principal: [email protected]
    Cache version: 4

Server: krbtgt/[email protected]
Client: [email protected]
Ticket etype: aes256-cts-hmac-sha1-96, kvno 1
Ticket length: 369
Auth time:  Sep 21 14:22:49 2018
Start time: Sep 21 14:23:55 2018
End time:   Sep 22 00:22:46 2018
Ticket flags: transited-policy-checked, pre-authent, forwarded, forwardable
Addresses: IPv4:130.237.234.74


My heimdal version is not bleeding edge:
1.6~git20131207+dfsg-1ubuntu1.2

Maybe this is a newly introduced bug, but at least is has worked.

Which version are you using and please copy+paste commands and output.

> And if I disable the proxiable and forwadable attributes on the kdc
> (with kadmin and attributes "disallow-proxiable,
> disallow-forwardable"), kinit can't anymore get a ticket.

If you do this, you must instruct kinit to behave accordingly, either with command
line arguments (--no-prox --no-forw) or in krb5.conf. kinit will not by itself
go from requesting a forwardable to requesting a non-forwardable ticket if the
former was not allowed.

Harald.