use time value of keytab

gssapi/krb5Token_test.go

@@ -58,10 +58,13 @@ func TestMechToken_newAuthenticatorWithSubkeyGeneration(t *testing.T) {
 	assert.Equal(t, int32(32771), a.Cksum.CksumType, "Checksum type in authenticator for SPNEGO mechtoken not as expected.")
 	assert.Equal(t, etypeID, a.SubKey.KeyType, "Subkey not of the expected type.")
 	assert.Equal(t, keyLen, len(a.SubKey.KeyValue), "Subkey value not of the right length")
-	// Test the subkey is initialised to random non-zero values. Not a perfect test but better than nothing.
-	assert.Condition(t, assert.Comparison(func() bool {
-		return a.SubKey.KeyValue[0] != 0 && a.SubKey.KeyValue[1] != 0 && a.SubKey.KeyValue[0] != a.SubKey.KeyValue[1]
-	}))
+	var nz bool
+	for _, b := range a.SubKey.KeyValue {
+		if b != byte(0) {
+			nz = true
+		}
+	}
+	assert.True(t, nz, "subkey not initialised")
 	assert.Condition(t, assert.Comparison(func() bool {
 		return a.SeqNumber > 0
 	}), "Sequence number is not greater than zero")

keytab/keytab.go

@@ -55,7 +55,11 @@ func (kt *Keytab) GetEncryptionKey(nameString []string, realm string, kvno int,
 	var key types.EncryptionKey
 	var t time.Time
 	for _, k := range kt.Entries {
-		if k.Principal.Realm == realm && len(k.Principal.Components) == len(nameString) && k.Key.KeyType == etype && (k.KVNO == uint32(kvno) || kvno == 0) && k.Timestamp.After(t) {
+		if k.Principal.Realm == realm && len(k.Principal.Components) == len(nameString) &&
+			k.Key.KeyType == etype &&
+			(k.KVNO == uint32(kvno) || kvno == 0) &&
+			k.Timestamp.After(t) {
+
 			p := true
 			for i, n := range k.Principal.Components {
 				if nameString[i] != n {
@@ -65,6 +69,7 @@ func (kt *Keytab) GetEncryptionKey(nameString []string, realm string, kvno int,
 			}
 			if p {
 				key = k.Key
+				t = k.Timestamp
 			}
 		}
 	}