Describe the bug
When a configured KerberosClient is used for S4U delegation, KerberosClient.CopyOrCreate() creates the internal S4U client using only the configuration, logger factory and transports.
Other relevant client settings are not copied and therefore fall back to their defaults.
This affects, among others:
- RenewTickets
- RefreshPollInterval
- MaximumRetries
- ConnectTimeout
- SendTimeout
- ReceiveTimeout
- AuthenticationOptions / KdcOptions
The most critical case for us is RenewTickets. Even if ticket renewal is enabled on the supplied delegation client, the internally created S4U client uses a new cache with ticket renewal disabled.
This causes S4U/KCD requests to fail once the internally cached TGT expires.
To Reproduce
Configure a delegation client, for example:
client.RenewTickets = true;
client.ConnectTimeout = TimeSpan.FromSeconds(10);
client.SendTimeout = TimeSpan.FromSeconds(15);
client.ReceiveTimeout = TimeSpan.FromSeconds(15);
Use this client for S4U delegation.
CopyOrCreate() creates the internal client as:
return new KerberosClient(
delegationClient.Configuration ?? config,
delegationClient.loggerFactory ?? logger,
delegationClient.Transports.ToArray())
{
CacheInMemory = true
};
The configured client properties are not copied.
Expected behavior
Relevant client settings should be preserved when creating the internal S4U client.
In particular, enabling RenewTickets on the supplied delegation client should also enable ticket renewal for the internally created client.
Additional context
For long-running services using S4U/KCD, this currently requires custom TGT refresh/recreation logic once the internal TGT expires.
Describe the bug
When a configured KerberosClient is used for S4U delegation, KerberosClient.CopyOrCreate() creates the internal S4U client using only the configuration, logger factory and transports.
Other relevant client settings are not copied and therefore fall back to their defaults.
This affects, among others:
The most critical case for us is RenewTickets. Even if ticket renewal is enabled on the supplied delegation client, the internally created S4U client uses a new cache with ticket renewal disabled.
This causes S4U/KCD requests to fail once the internally cached TGT expires.
To Reproduce
Configure a delegation client, for example:
Use this client for S4U delegation.
CopyOrCreate() creates the internal client as:
The configured client properties are not copied.
Expected behavior
Relevant client settings should be preserved when creating the internal S4U client.
In particular, enabling RenewTickets on the supplied delegation client should also enable ticket renewal for the internally created client.
Additional context
For long-running services using S4U/KCD, this currently requires custom TGT refresh/recreation logic once the internal TGT expires.