On 12/22/2016 09:15 AM, Sorin Manolache wrote:
[...]
> Therefore, at moment t_2, when the user makes a request to the http
> server, his ticket that uses the kvno 2 keys cannot be validated by the
> service that uses the keytab with the kvno 1 keys.
Yes, this is a known weakness of the current kadmin. I think it was
first reported here:
http://krbdev.mit.edu/rt/Ticket/Display.html?id=5339
It becomes a larger problem with clustered services. We discussed some
possible resolutions in this thread on the krbdev list:
http://mailman.mit.edu/pipermail/krbdev/2013-January/011355.html
In terms of immediate resolution, the only option I know of is to use
Roland's admin system:
http://oskt.secure-endpoints.com/krb5_admin.html
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
