Bug 78677

Summary: Kerberos tickets not refreshed while unlocking screensaver
Product: [Unmaintained] kscreensaver Reporter: Felipe Alfaro Solana <felipe_alfaro>
Component: kcheckpassAssignee: kscreensaver bugs tracking <kscreensaver-bugs-null>
Status: RESOLVED DUPLICATE    
Severity: wishlist CC: nocturn
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: RedHat Enterprise Linux   
OS: Linux   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Felipe Alfaro Solana 2004-03-29 16:42:19 UTC 
Version:            (using KDE KDE 3.2.1)
Installed from:    RedHat RPMs
OS:          Linux

I do always log onto KDE by using a Kerberos-enabled user account. KDM does gracefully log in and automatically gets the Ticket Granting Ticket from the KDC.

Then, if I lock my session using KScreensaver for an extended period of time, such as the TGT expires, KScreensaver prompts me for my password and checks it against the KDC. However, KScreensaver doesn't try to renew my TGT and instead, I'm left on a KDE session with an expired TGT ticket that I must manually renew using "kinit".

Since KScreensaver is able to unlock my KDE session by contacting the KDC, would it be possible for kScreensaver to renew the existing TGT?

I find this particular behavior very irritating when I suspend my laptop the time enough to let my TGT expire. After resuming, the KDE session comes out locked by KScreensaver, which prompts me for my password, and contacts the KDC to check it. The screen is unlock, but my TGT ticket is still expired. Using "klist" at a konsole window reveals this. Thus, I must use "kinit" to renew my TGT, which is very uncomfortable. Since KScreensaver does prompt for my password, it would be very nice if it did automatically renew my TGT,
Comment 1 Guy Van Sanden 2004-04-29 19:03:54 UTC 
If I'm not mistaken, this should be handled by the pam_krb5 module.... kScreensaver does not know about kerberos, it just passes through pam.

The initial ticket is created by that pam_krb5 module, so renewals should be done there.
Comment 2 Oswald Buddenhagen 2007-06-25 17:26:07 UTC 
wrong direction, but anyway ... :)

*** This bug has been marked as a duplicate of 127012 ***