Ticket Viewer on 10.11.5 (and perhaps other OS versions)

AARP
New Contributor III

I am finding that when I log into my computer, I get a kerberos tgt ticket with the user name in lower-case (i.e. jsmith@TEST.COM) . But if I request a kerberos TGT ticket using Ticket Viewer on 10.11.5 (on a Mac bound to Active Directory) I get the ticket but the user name is in all capitals. So for example, if I request "jsmith@TEST.COM", I get a ticket named "JSMITH@TEST.COM". This behavior has changed from earlier versions of the OS. On Snow Leopard, if you use Ticket Viewer to make the request, you would get back "jsmith@TEST.COM". Interestingly, if I use kinit to request the ticket, I get the ticket with the correct case (jsmith@TEST.COM).
The reason this is important is that apps like Outlook 2016 care about the case of the user name in the kerberos tgt. It also means that if a user establishes a session longer than 10 hours (AD's kerberos lease period), they will not be able to use ticket viewer to request a new ticket and have it work with Outlook 2016.

1 REPLY 1

htse
Contributor III

Going that far back to 10.6, I might suggest that it may be a difference between Heimdal Kerberos since 10.7 from MIT Kerberos in 10.6.

I don't know if this will provide you any comfort, but Kerberos tickets are also renewed when returning from the lock screen

https://support.apple.com/en-ca/HT202545