Added a TTL to the credentials

Signed-off-by: Levi Gross <levi@levigross.com>

credentials/credentials.go

@@ -2,11 +2,12 @@
 package credentials
 
 import (
+	"time"
+
 	"github.com/hashicorp/go-uuid"
 	"gopkg.in/jcmturner/gokrb5.v5/iana/nametype"
 	"gopkg.in/jcmturner/gokrb5.v5/keytab"
 	"gopkg.in/jcmturner/gokrb5.v5/types"
-	"time"
 )
 
 const (
@@ -18,13 +19,15 @@ const (
 // Contains either a keytab, password or both.
 // Keytabs are used over passwords if both are defined.
 type Credentials struct {
-	Username        string
-	displayName     string
-	Realm           string
-	CName           types.PrincipalName
-	Keytab          keytab.Keytab
-	Password        string
-	Attributes      map[int]interface{}
+	Username    string
+	displayName string
+	Realm       string
+	CName       types.PrincipalName
+	Keytab      keytab.Keytab
+	Password    string
+	Attributes  map[int]interface{}
+	ValidUntil  time.Time
+
 	authenticated   bool
 	human           bool
 	authTime        time.Time
@@ -102,6 +105,11 @@ func (c *Credentials) HasKeytab() bool {
 	return false
 }
 
+// SetValidUntil sets the TTL of the credentials
+func (c *Credentials) SetValidUntil(validUntil time.Time) {
+	c.ValidUntil = validUntil
+}
+
 // HasPassword queries if the Credentials has a password defined.
 func (c *Credentials) HasPassword() bool {
 	if c.Password != "" {

service/APExchange.go

@@ -80,6 +80,7 @@ func ValidateAPREQ(APReq messages.APReq, kt keytab.Keytab, sa string, cAddr stri
 	creds = credentials.NewCredentialsFromPrincipal(a.CName, a.CRealm)
 	creds.SetAuthTime(t)
 	creds.SetAuthenticated(true)
+	creds.SetValidUntil(APReq.Ticket.DecryptedEncPart.EndTime)
 	isPAC, pac, err := APReq.Ticket.GetPACType(kt, sa)
 	if isPAC && err != nil {
 		return false, creds, err