krb5/krb5 — pull request #170 by nalind (2014-07-08 17:48:03+00:00)
Title: Fix verification of TGTs with lifetime < 5 minutes

When obtaining a service ticket for use in verifying a TGT, we request a
ticket with a lifetime of five minutes. If the KDC returns credentials
that have a shorter lifetime (which is always the case if we're fetching
TGTs that are sufficiently short-lived), we end up storing them in the
temporary cache and then failing to find them when we search for them
immediately afterward.

To avoid this, after computing (now + 5 minutes) for use as the lifetime
of the desired credentials, if the TGT's endtime is lower, just use the
TGT's endtime.