1*7f2fe78bSCy Schubert<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 2*7f2fe78bSCy Schubert<html><head> 3*7f2fe78bSCy Schubert<meta name="GENERATOR" content="Microsoft� HTML Help Workshop 4.1"> 4*7f2fe78bSCy Schubert<link rel="stylesheet" type="text/css" href="Leash.css"> 5*7f2fe78bSCy Schubert<title>Troubleshooting</title></head> 6*7f2fe78bSCy Schubert 7*7f2fe78bSCy Schubert<body> 8*7f2fe78bSCy Schubert<h1> <a name="" top="">Troubleshooting</a></h1> 9*7f2fe78bSCy Schubert<ul id="helpul"> 10*7f2fe78bSCy Schubert<li> <a href="#renew"> When I try to renew my ticket, why do I get an error message and see the Get Ticket window? </a></li> 11*7f2fe78bSCy Schubert<li><a href="#expire"> Why did my tickets expire even though I had Automatically Renew Tickets turned on? </a></li> 12*7f2fe78bSCy Schubert 13*7f2fe78bSCy Schubert<li> <a href="#ticket-lifetime"> Why doesn't my ticket lifetime match the lifetime I selected with the slider in the Get Ticket window? </a></li> 14*7f2fe78bSCy Schubert 15*7f2fe78bSCy Schubert 16*7f2fe78bSCy Schubert 17*7f2fe78bSCy Schubert<li> <a href="#set-preferences"> How do I set properties like the default ticket lifetime? </a></li> 18*7f2fe78bSCy Schubert<li> <a href="#set-preferences"> I have multiple principals and have 19*7f2fe78bSCy Schuberttickets for all of them, but sometimes an application that requires 20*7f2fe78bSCy SchubertKerberos doesn't work. What's going on? </a></li> 21*7f2fe78bSCy Schubert</ul> 22*7f2fe78bSCy Schubert 23*7f2fe78bSCy Schubert 24*7f2fe78bSCy Schubert<a name="renew"> <h3> When I try to renew my ticket, why do I get an error message and see the Get Ticket window? </h3> </a> 25*7f2fe78bSCy Schubert<p> 26*7f2fe78bSCy SchubertThe ticket cannot be renewed. This could be because the ticket was not 27*7f2fe78bSCy Schubertflagged as renewable when you obtained it, or because it expired before 28*7f2fe78bSCy Schubertyou could renew it, or because the ticket's renewable lifetime has been 29*7f2fe78bSCy Schubertreached. <a href="HTML/Tickets.htm#renewable">About: Renewable Tickets</a> </p> 30*7f2fe78bSCy Schubert<p> 31*7f2fe78bSCy Schubert<a href="#top">Back to top</a></p> 32*7f2fe78bSCy Schubert 33*7f2fe78bSCy Schubert<a name="expire"> </a><h3><a name=" expire"> Why did my tickets expire even though I had Automatically Renew Tickets turned on? </a></h3> 34*7f2fe78bSCy Schubert<p> MIT Kerberos can only renew your tickets if the program is running 35*7f2fe78bSCy Schubertand active. It cannot renew your tickets if you exit the program or if 36*7f2fe78bSCy Schubertyour computer is turned off or in hibernation mode.</p> 37*7f2fe78bSCy Schubert<p> 38*7f2fe78bSCy Schubert<a href="#top">Back to top</a></p> 39*7f2fe78bSCy Schubert 40*7f2fe78bSCy Schubert<a name="ticket-lifetime"> </a><h3><a name="ticket-lifetime"> Why doesn't my ticket lifetime match the lifetime I selected with the slider in the Get Ticket window? </a></h3> 41*7f2fe78bSCy Schubert<p> Your Kerberos installation is configured for a maximum ticket 42*7f2fe78bSCy Schubertlifetime length that is determined by the administrators. If your 43*7f2fe78bSCy Schubertinstallation uses a shorter maximum ticket lifetime than the default, 44*7f2fe78bSCy Schubertthe Ticket Lifetime slider might show the default maximum instead of 45*7f2fe78bSCy Schubertthe actual maximum.</p> 46*7f2fe78bSCy Schubert<p> For example, if your Kerberos installation has been configured to 47*7f2fe78bSCy Schubertissue tickets that expire in 5 hours or less, you might be able to move 48*7f2fe78bSCy Schubertthe slider to show 12 hours but you would still be issued a ticket with 49*7f2fe78bSCy Schuberta lifetime of only 5 hours.</p> 50*7f2fe78bSCy Schubert<p> 51*7f2fe78bSCy Schubert<a href="#top">Back to top</a></p> 52*7f2fe78bSCy Schubert 53*7f2fe78bSCy Schubert 54*7f2fe78bSCy Schubert<h3> <a name="set-preferences"> How do I set properties like the default ticket lifetime?</a></h3> 55*7f2fe78bSCy Schubert<p> 56*7f2fe78bSCy SchubertYou cannot use the MIT Kerberos program to set properties such as 57*7f2fe78bSCy Schubertdefault ticket lifetimes. Instead, edit the appropriate configuration 58*7f2fe78bSCy Schubertfile. For more information, visit the <a href="https://web.mit.edu/kerberos/krb5-latest/doc/krb_admins/conf_files/index.html" target="new"> MIT Kerberos documentation site. </a> 59*7f2fe78bSCy Schubert </p> 60*7f2fe78bSCy Schubert<p> 61*7f2fe78bSCy Schubert<a href="#top">Back to top</a></p> 62*7f2fe78bSCy Schubert 63*7f2fe78bSCy Schubert<h3> <a name="default-principal"> I have multiple principals and have 64*7f2fe78bSCy Schuberttickets for all of them, but sometimes an application that requires 65*7f2fe78bSCy SchubertKerberos doesn't work. What's going on? </a></h3> 66*7f2fe78bSCy Schubert<p> 67*7f2fe78bSCy SchubertWhen you try to use a Keberized application, it requests your 68*7f2fe78bSCy Schubertcredentials from Kerberos. Some applications do this by asking for a 69*7f2fe78bSCy Schubertspecific principal's credentials, but others ask generically. When 70*7f2fe78bSCy Schubertapplications make a generic request, Kerberos does not know which 71*7f2fe78bSCy Schubertprincipal is being authenticated and checks the default principal for 72*7f2fe78bSCy Schuberttickets. If the default principal is not the one being authenticated, 73*7f2fe78bSCy Schubertthe application will usually simply fail to work with no warning or 74*7f2fe78bSCy Schubertnotice. <a href="HTML/Make_Default.htm">How to: Make Default Principal</a> 75*7f2fe78bSCy Schubert 76*7f2fe78bSCy Schubert 77*7f2fe78bSCy Schubert </p> 78*7f2fe78bSCy Schubert<p> 79*7f2fe78bSCy Schubert<a href="#top">Back to top</a></p> 80*7f2fe78bSCy Schubert</body></html> 81