X-RT-Original-Encoding: utf-8
Content-Transfer-Encoding: binary
Content-Disposition: inline
References: <rt-4.4.4-26136-1594326664-257.0-0-0@mit.edu>
 <RT-Ticket-8925@mit.edu> <rt-4.4.4-70189-1594732155-1388.8925-0-0@mit.edu>
 <rt-4.4.4-70196-1594746854-1477.8925-0-0@mit.edu>
 <rt-4.4.4-70196-1594754825-647.8925-0-0@mit.edu>
X-Mailer: MIME-tools 5.507 (Entity 5.507)
Content-Type: text/html; charset="utf-8"
In-Reply-To: <rt-4.4.4-70196-1594754825-647.8925-0-0@mit.edu>
Message-ID: <rt-4.4.4-26916-1594842995-441.8925-0-0@mit.edu>
MIME-Version: 1.0
X-RT-Interface: Web
RT-Send-CC:
Content-Length: 564

* krb5_get_credentials() ordinarily handles both checking the cache and storing into the cache.&nbsp; For S4U2Self requests, it calls&nbsp;k5_get_proxy_cred_from_kdc(), which stores into the cache but does not check the cache, so repeated krb5_get_credentials() S4U2Self calls will result in duplicate cache entries.&nbsp; (GSSAPI does its own cache check before making the S4U2Proxy request, and kvno -P uses the krb5_get_credentials_for_proxy() wrapper which does a cache check.&nbsp; So this is purely an issue with the krb5_get_credentials() API.)<br />
&nbsp;