Subject: [Ietf-krb-wg] Usability of Renewable Tickets

From: Jeffrey Altman <[email-masked]>
Date: Tue, 21 Aug 2012 13:32:57 -0400

In recent days it has come to my attention that various client libraries
and KDCs imposes a variety of constraints on the use of renewable
tickets which restrict their usability.  Especially in cross-vendor
deployments.

Heimdal 1.5.x and earlier clients for example cannot request a renewable
service ticket.  Only initial TGTs can be renewable.

Windows Server 2003 will issue renewable and forwardable TGTs and
service tickets but will not renew anything other than an initial TGT.

MIT's client libraries only permit renewals of TGTs.  Attempts to renew
service tickets result in a mismatched server name and ticket being sent
to the KDC.

It would be useful as guidance to implementers for this working group to
come to a consensus on:

 * which ticket types should be renewable

 * which ticket types should be renewed by the KDC

 * the interactions of the renewable flag and other ticket flags

 * the use of RENEWABLE_OK by clients

It is my hope that such guidance when implemented (and preferably
backported by vendors) could quickly raise the level of interoperability
and the usability of renewable Kerberos credentials.

Jeffrey Altman

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Greg Hudson <[email-masked]>
Date: Tue, 21 Aug 2012 14:44:57 -0400

> service tickets result in a mismatched server name and ticket being sent

This was fixed in 1.9, and I just tested with the current code.  In 1.8
or earlier, the client code would try to use a TGT to renew the service
ticket, which would fail on the client if the cache doesn't also contain
a TGT, and would fail on the KDC if it does.

See also:

http://krbdev.mit.edu/rt/Ticket/Display.html?id=6699&user=guest&pass=guest

(I realize our latest Windows release is based on 1.6.x, and therefore
still has this bug.  We're working on it.)