hi, I have 2 questions concerning user-to-user authentication.

First, I'm currently trying to develop a client/server application that
uses kerberos 'user-to-user' authentication mechanism.
Looking at kerberos source code examples, I've seen that u2u
authentication is implemented in a reversed way, that is to say client
issues a recvauth(..) and server issues a sendauth(..).
With this schema, server credential cache grows up for each connection
as it has to get a new u2u TGS for clients that don't send an previously
sent TGT.
I would like to implement u2u authentication in the standard way in
order to avoid this drawback but I don't know what are the trade-off of
this action. Can you give me some pointers ?

Next, playing with kerberos source code example of user-to-user
authentication, I've seen that it's possible to grant access to the
server using an expired ticket.
By default, it seems that there is no control made on the TGT that is
used to build a TGS for user-to-user auth. I've looked at do_tgs_req.c
and haven't seen any trace of this kind of check. Have I missed some kdc
configuration that enables this feature ?

Best regards,
Matthieu Hautreux
CEA