Let libgssapi see TGTs in the MSLSA cache When the current user is a local administrator of a windows machine where User Account Control (UAC) is enabled, the Windows LSA will return a block of zeros as the session key for any TGT entry in the MSLSA: cache. The lcc_retrieve() implementation checks for such "null" session keys and prevents them from escaping to callers (as attempts to use them would encounger strange errors). However, when the TGT is the only entry in the cache, this filtering prevents scan_ccache() from detecting that the cache contains non-expired credentials (and that there is a TGT present). Since scan_ccache() is only looking at metadata in the cache entries, and does not need to actually use any tickets or session keys, set the KRB5_TC_NOTICKET flag on the ccache before scanning it. This will allow the MSLSA implementation to return a cred for the TGT entry and cause the GSSAPI credential selection algorithm to function properly. (cherry picked from commit 0794746f8d8e6b8ce3748d442d2bc1faecf960ce) https://github.com/krb5/krb5/commit/f744357cb51b03ce861613f84ae198bb92ceeca7 Author: Ben Kaduk Committer: Tom Yu Commit: f744357cb51b03ce861613f84ae198bb92ceeca7 Branch: krb5-1.13 src/lib/gssapi/krb5/acquire_cred.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)