Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.427 (Entity 5.427)
RT-Send-CC:
X-RT-Original-Encoding: iso-8859-1
Content-Length: 681

I think the problem is that keyring ccaches created by 
krb5_krcc_ptcursor_next do not look up the time offsets.  In the case 
where kg_cred_resolve gets a cache from the collection via 
krb5_cc_select, krb5_krcc_resolve is not called and we don't get the time 
offsets.  In the case where kg_cred_resolve falls back to 
krb5int_cc_default, krb5_krcc_resolve is called and we get offsets.

The fix is as simple as moving the time offset lookup code from 
krb5_krcc_resolve() into make_cache().

(In the long term, we hope to make fetching the time offset from the 
cache into an explicit operation, in order to better handle cases where 
different realms have different KDC times.)