* krb5_get_credentials() ordinarily handles both checking the cache and storing into the cache.&nbsp; For S4U2Self requests, it calls&nbsp;k5_get_proxy_cred_from_kdc(), which stores into the cache but does not check the cache, so repeated krb5_get_credentials() S4U2Self calls will result in duplicate cache entries.&nbsp; (GSSAPI does its own cache check before making the S4U2Proxy request, and kvno -P uses the krb5_get_credentials_for_proxy() wrapper which does a cache check.&nbsp; So this is purely an issue with the krb5_get_credentials() API.)<br />
&nbsp;