dotnet / dotnet/Kerberos.NET

KerberosClient.CopyOrCreate does not preserve client settings

Open
#434 0 comments 4 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
567
Forks
109
PR merge metrics
No merged PRs in 30d

Description

### Describe the bug

When a configured KerberosClient is used for S4U delegation, KerberosClient.CopyOrCreate() creates the internal S4U client using only the configuration, logger factory and transports.
Other relevant client settings are not copied and therefore fall back to their defaults.
This affects, among others:

- RenewTickets
- RefreshPollInterval
- MaximumRetries
- ConnectTimeout
- SendTimeout
- ReceiveTimeout
- AuthenticationOptions / KdcOptions

The most critical case for us is **RenewTickets**. Even if ticket renewal is enabled on the supplied delegation client, the internally created S4U client uses a new cache with ticket renewal disabled.
This causes S4U/KCD requests to fail once the internally cached TGT expires.

### To Reproduce
Configure a delegation client, for example:
```
client.RenewTickets = true;
client.ConnectTimeout = TimeSpan.FromSeconds(10);
client.SendTimeout = TimeSpan.FromSeconds(15);
client.ReceiveTimeout = TimeSpan.FromSeconds(15);
```
Use this client for S4U delegation.
CopyOrCreate() creates the internal client as:
```
return new KerberosClient(
delegationClient.Configuration ?? config,
delegationClient.loggerFactory ?? logger,
delegationClient.Transports.ToArray())
{
CacheInMemory = true
};
```
The configured client properties are not copied.

### Expected behavior
Relevant client settings should be preserved when creating the internal S4U client.
In particular, enabling **RenewTickets** on the supplied delegation client should also enable ticket renewal for the internally created client.

### Additional context
For long-running services using S4U/KCD, this currently requires custom TGT refresh/recreation logic once the internal TGT expires.

Contributor guide

Open the contributing guide

Research direction

Start at KerberosClient.CopyOrCreate, using the issue's constructor snippet and the listed settings as the checklist. Trace how the internally created S4U client is used for delegation, then verify that the relevant client properties, especially RenewTickets, are preserved and that long-running S4U/KCD requests no longer lose ticket renewal.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.