public Class KDCOptions

KDCOptions   ::= KerberosFlags
     -- reserved(0),
     -- forwardable(1),
     -- forwarded(2),
     -- proxiable(3),
     -- proxy(4),
     -- allow-postdate(5),
     -- postdated(6),
     -- unused7(7),
     -- renewable(8),
     -- unused9(9),
     -- unused10(10),
     -- opt-hardware-auth(11),
     -- unused12(12),
     -- unused13(13),
-- 15 is reserved for canonicalize
     -- unused15(15),
-- 26 was unused in 1510
     -- disable-transited-check(26),
     -- renewable-ok(27),
     -- enc-tkt-in-skey(28),
     -- renew(30),
     -- validate(31)

KerberosFlags   ::= BIT STRING (SIZE (32..MAX))
                     -- minimum number of bits shall be sent,
                     -- but no fewer than 32

This definition reflects the Network Working Group RFC 4120 specification available at http://www.ietf.org/rfc/rfc4120.txt.

This class appears as data field in the initial request(KRB_AS_REQ) or subsequent request(KRB_TGS_REQ) to the KDC and indicates the flags that the client wants to set on the tickets. The optional bits are:

• KDCOptions.RESERVED
• KDCOptions.FORWARDABLE
• KDCOptions.FORWARDED
• KDCOptions.PROXIABLE
• KDCOptions.PROXY
• KDCOptions.ALLOW_POSTDATE
• KDCOptions.POSTDATED
• KDCOptions.RENEWABLE
• KDCOptions.RENEWABLE_OK
• KDCOptions.ENC_TKT_IN_SKEY
• KDCOptions.RENEW
• KDCOptions.VALIDATE

Various checks must be made before honoring an option. The restrictions on the use of some options are as follows:

1. FORWARDABLE, FORWARDED, PROXIABLE, RENEWABLE options may be set in subsequent request only if the ticket_granting ticket on which it is based has the same options (FORWARDABLE, FORWARDED, PROXIABLE, RENEWABLE) set.
2. ALLOW_POSTDATE may be set in subsequent request only if the ticket-granting ticket on which it is based also has its MAY_POSTDATE flag set.
3. POSTDATED may be set in subsequent request only if the ticket-granting ticket on which it is based also has its MAY_POSTDATE flag set.
4. RENEWABLE or RENEW may be set in subsequent request only if the ticket-granting ticket on which it is based also has its RENEWABLE flag set.
5. POXY may be set in subsequent request only if the ticket-granting ticket on which it is based also has its PROXIABLE flag set, and the address(es) of the host from which the resulting ticket is to be valid should be included in the addresses field of the request.
6. FORWARDED, PROXY, ENC_TKT_IN_SKEY, RENEW, VALIDATE are used only in subsequent requests.