Subject: Re: expired second tickets

From: Sam Hartman <[email-masked]>
Date: 02 Aug 2001 17:15:35 -0400

>>>>> "Michael" == Michael Thomas <[email-masked]> writes:

    Michael> In implementing a U-U client, I've run into a question
    Michael> which I can't figure out whether is a bug or a feature.
    Michael> That is, in a u-u flow, if the supplied second TGT is
    Michael> expired, should the KDC reject the request? The MIT KDC
    Michael> doesn't, but it seems sort of odd that the KDC wouldn't
    Michael> check the second ticket's validity too.

    Michael> Comments?

If the spec is sufficiently unclear that you have questions at all, it
seems likely that a client SHOULD work correctly with a KDC that
refuses expired second tickets.

---

From: Michael Thomas <[email-masked]>
Date: Sun, 5 Aug 2001 03:47:13 -0700 (PDT)

> refuses expired second tickets.

   I'm more than willing to work correctly (hence my question),
   but I'm not quite sure which error code the KDC would send
   back if it were unhappy...

	   Mike