cannot create forwardable kerberos tickets
Bug #667809 reported by
Andreas Andersson
This bug affects 6 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| heimdal (Debian) |
Fix Released
|
Unknown
|
|||
| heimdal (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
Bug Description
When issuing "kinit -f myname@
will not be forwardable only proxiable. This can be confirmed with the command
"klist -f" after receiving the ticket.
Revision history for this message
| Harald Barth (haba+launchpad) wrote | #1 |
| Changed in heimdal (Debian): | |
| status: | Unknown → Confirmed |
| Changed in heimdal (Ubuntu): | |
| status: | New → Confirmed |
| Changed in heimdal (Debian): | |
| status: | Confirmed → Fix Released |
To post a comment you must log in.
Impact: As the documentation of klist and all known support documentation says that -f means forwardable this creates support hell.
The bug is that -f actually means "--non-forwardable" and overrides what is in krb5.conf.
It has been reported upstream and fixed in GIT, so there is a patch available which could be incorperated into the package easily.
The bigger picture of the problem is that the whole packet has its origin in a snapshot from GIT (taken in february) and not a real heimdal release. That can bee seen by comparing the output of klist --version and the version of the package. I recommend the maintainer(s) to use real releases as a base for the packaging.
Regards,
Harald.