From krb5-bugs-incoming-bounces@PCH.MIT.EDU Tue Sep 18 16:25:51 2007 Received: from pch.mit.edu (PCH.MIT.EDU [18.7.21.90]) by krbdev.mit.edu (8.12.9) with ESMTP id l8IKPpHW028510; Tue, 18 Sep 2007 16:25:51 -0400 (EDT) Received: from pch.mit.edu (pch.mit.edu [127.0.0.1]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l8IKPk8H004662; Tue, 18 Sep 2007 16:25:46 -0400 Received: from pacific-carrier-annex.mit.edu (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.7.21.83]) by pch.mit.edu (8.13.6/8.12.8) with ESMTP id l8IKMpFP003867 for ; Tue, 18 Sep 2007 16:22:51 -0400 Received: from mit.edu (W92-130-BARRACUDA-2.MIT.EDU [18.7.21.223]) by pacific-carrier-annex.mit.edu (8.13.6/8.9.2) with ESMTP id l8IKMjDf004405 for ; Tue, 18 Sep 2007 16:22:45 -0400 (EDT) Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31]) by mit.edu (Spam Firewall) with ESMTP id E79407CD307 for ; Tue, 18 Sep 2007 16:22:40 -0400 (EDT) Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l8IKMeZb006311 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO) for ; Tue, 18 Sep 2007 16:22:40 -0400 Received: from rapier.boston.redhat.com (rapier.boston.redhat.com [172.16.80.53]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l8IKMd2k025626 for ; Tue, 18 Sep 2007 16:22:39 -0400 Received: from rapier.boston.redhat.com (localhost.localdomain [127.0.0.1]) by rapier.boston.redhat.com (8.14.1/8.14.1) with ESMTP id l8IKMdvE020292 for ; Tue, 18 Sep 2007 16:22:39 -0400 Received: (from nalin@localhost) by rapier.boston.redhat.com (8.14.1/8.14.1/Submit) id l8IKMd7i020291; Tue, 18 Sep 2007 16:22:39 -0400 Date: Tue, 18 Sep 2007 16:22:39 -0400 Message-Id: <200709182022.l8IKMd7i020291@rapier.boston.redhat.com> To: krb5-bugs@mit.edu Subject: kdc misreports key expiration time From: Nalin Dahyabhai X-send-pr-version: 3.99 X-Spam-Score: 0.00 X-Spam-Flag: NO X-Scanned-By: MIMEDefang 2.42 X-Mailman-Approved-At: Tue, 18 Sep 2007 16:25:45 -0400 X-BeenThere: krb5-bugs-incoming@mailman.mit.edu X-Mailman-Version: 2.1.6 Precedence: list Reply-To: Nalin Dahyabhai Sender: krb5-bugs-incoming-bounces@PCH.MIT.EDU Errors-To: krb5-bugs-incoming-bounces@PCH.MIT.EDU >Submitter-Id: net >Originator: >Organization: >Confidential: no >Synopsis: The KDC reports the principal expiration time rather than the key expiration time. >Severity: non-critical >Priority: low >Category: krb5-kdc >Class: sw-bug >Release: 1.6.2 >Environment: System: Linux rapier.boston.redhat.com 2.6.21-1.3230.fc8 #1 SMP Wed Jun 20 15:59:23 EDT 2007 x86_64 x86_64 x86_64 GNU/Linux Architecture: x86_64 >Description: Sadique Puthen noted that he kept getting password expiration warnings when his account was about to expire, and chased it down to the KDC. >How-To-Repeat: Set an entry in the KDC database to have no password expiration date, but give it an entry expiration date in the near future. >Fix: This patch should match the behavior described in RFC4120: Index: src/kdc/do_as_req.c =================================================================== --- src/kdc/do_as_req.c (revision 19949) +++ src/kdc/do_as_req.c (working copy) @@ -372,7 +372,14 @@ goto errout; } reply_encpart.nonce = request->nonce; - reply_encpart.key_exp = client.expiration; + if (client.expiration == 0) { + reply_encpart.key_exp = client.pw_expiration; + } else if (client.pw_expiration == 0) { + reply_encpart.key_exp = client.expiration; + } else { + reply_encpart.key_exp = client.pw_expiration < client.expiration ? + client.pw_expiration : client.expiration; + } reply_encpart.flags = enc_tkt_reply.flags; reply_encpart.server = ticket_reply.server;