On 08/05/2016 02:48 PM, Michael Howe wrote: > When a client has an existing (forwardable) ticket, and the krbtgt is > rekeyed with -keepold, most things keep working. However, if that > ticket is used with SSH using GSSAPIDelegateCredentials=yes it seems to > make the forwarded ticket unusable - the KDC returns 'Bad encryption > type' whenever it's used. (I've not tested other applications that > might forward credentials.)
I can reproduce this bug under 1.12 (the version of krb5 in Debian Jessie) but not master. I believe it to be a previously unknown manifestation of http://krbdev.mit.edu/rt/Ticket/Display.html?id=8139 which was previously believed to only affect S4U2Proxy operations. That bug was fixed in 1.14. The fix for this bug is fairly invasive, so it wouldn't be easy to put together a safe backport. I think it would be possible to work around the bug by ignoring errors from krb5_c_verify_checksum() in kdc_authdata.c:verify_ad_signedpath_checksum(). ________________________________________________ Kerberos mailing list Kerberos@mit.edu https://mailman.mit.edu/mailman/listinfo/kerberos
