Re: Usability of Renewable Tickets

On 08/21/2012 01:32 PM, Jeffrey Altman wrote:
> MIT's client libraries only permit renewals of TGTs.  Attempts to renew
> service tickets result in a mismatched server name and ticket being sent
> to the KDC.

This was fixed in 1.9, and I just tested with the current code.  In 1.8
or earlier, the client code would try to use a TGT to renew the service
ticket, which would fail on the client if the cache doesn't also contain
a TGT, and would fail on the KDC if it does.

See also:

http://krbdev.mit.edu/rt/Ticket/Display.html?id=6699&user=guest&pass=guest

(I realize our latest Windows release is based on 1.6.x, and therefore
still has this bug.  We're working on it.)

_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg