Subject: Pine 4.44 not reusing valid K5 SVC TKT to form GSS SASL authenticator

From: Seth Meyer <[email-masked]>
Date: Sun, 27 Jan 2002 14:49:34 -0500

My build of Pine 4.44 appears to not be reusing valid K5 service tickets.
I am able to generate the K5 CCACHE below by switching between folders on
a GSS-capable UW IMAP server:

Ticket cache: FILE:/ticket/k5cc_33204_17738
Default principal: [email-masked]

Valid starting     Expires            Service principal
01/27/02 13:47:11  01/27/02 23:47:11  krbtgt/[email-masked]
01/27/02 13:48:42  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:48:42  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:48:54  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:48:56  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:55:09  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:55:13  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:55:18  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:55:24  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:55:30  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:57:21  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:57:32  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:57:34  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:57:38  01/27/02 23:47:11  imap/[email-masked]
01/27/02 13:57:43  01/27/02 23:47:11  imap/[email-masked]
01/27/02 14:02:24  01/27/02 23:47:11  imap/[email-masked]
01/27/02 14:03:16  01/27/02 23:47:11  imap/[email-masked]
01/27/02 14:03:24  01/27/02 23:47:11  imap/[email-masked]
01/27/02 14:03:33  01/27/02 23:47:11  imap/[email-masked]

Using network trace data I have verified that everytime I switch folders,
Pine talks to the KDC,  in lieu of reusing the valid svc tkt to form a GSS
SASL authenticator.

I have reproduced  this behavior with Pine 4.43 and 4.44 with MIT Krb5
1.2.2 and 1.2.1 libraries,  against imap version 2001.315um1 (a
UMich-modified version of the 2001 UW IMAP release,  built against MIT
1.2.2 K5 libraries),  on the Solaris 8 64 and 32 bit environments,  with
Forte 6.2 (patched).  Our KDC is a slightly-modified version of MIT
Krb5 1.2.1.

Has anybody seen this behavior at their site?  I have network trace data
and Pine debug files for anyone interested in pursuing this.

  Seth
-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------

---

From: Mark Crispin <[email-masked]>
Date: Mon, 28 Jan 2002 11:01:05 -0800 (PST)

Hello -

I tried on two different platforms, and could not reproduce the problem.  I
wonder if there is some problem in your modifications to the MIT Kerberos
libraries.

The details of Kerberos tickets and their reuse occurs within the MIT Kerberos
libraries and not in Pine or its c-client library.  The c-client library does
gss_init_sec_context() calls for that principal, as specified in the SASL
specification.  It is completely clueless about tickets, much less ticket
caches.  For some reason, your Kerberos library's gss_init_sec_context()
implementation is re-negotiating with the KDC instead of using the cache.

I'm sorry that I couldn't be more helpful.  Have you tried a Pine built with
an unmodified MIT Kerberos library?

-- Mark --