>>>>> "gsu@UU" == gsu@UU NET via RT <rt-comment@krbdev.mit.edu> writes:
    gsu@UU> I noticed that if there are more than one credentials for
    gsu@UU> the same server, krb5_get_credentials returns the first
    gsu@UU> one found which may be expired.  I have to use
    gsu@UU> krb5_cc_retrieve_cred with KRB5_TC_MATCH_TIMES option to
    gsu@UU> get the good credential and send to the server for
    gsu@UU> authentication.  Since I have to keep getting new service
    gsu@UU> ticket, I thought it would be nice if I can remove all old
    gsu@UU> ones.

The logic used by krb5_mk_req in 1.3.x should correctly use only
unexpired credentials.  Previous versions of Kerberos did not tend to
do this correctly.