Posted on 06-14-2016 09:44 AM
I am finding that when I log into my computer, I get a kerberos tgt ticket with the user name in lower-case (i.e. jsmith@TEST.COM) . But if I request a kerberos TGT ticket using Ticket Viewer on 10.11.5 (on a Mac bound to Active Directory) I get the ticket but the user name is in all capitals. So for example, if I request "jsmith@TEST.COM", I get a ticket named "JSMITH@TEST.COM". This behavior has changed from earlier versions of the OS. On Snow Leopard, if you use Ticket Viewer to make the request, you would get back "jsmith@TEST.COM".
Interestingly, if I use kinit to request the ticket, I get the ticket with the correct case (jsmith@TEST.COM).
The reason this is important is that apps like Outlook 2016 care about the case of the user name in the kerberos tgt. It also means that if a user establishes a session longer than 10 hours (AD's kerberos lease period), they will not be able to use ticket viewer to request a new ticket and have it work with Outlook 2016.
Posted on 06-15-2016 02:57 PM
Going that far back to 10.6, I might suggest that it may be a difference between Heimdal Kerberos since 10.7 from MIT Kerberos in 10.6.
I don't know if this will provide you any comfort, but Kerberos tickets are also renewed when returning from the lock screen
https://support.apple.com/en-ca/HT202545