How to know if the Kerberos ticket has expired

Question

Hi, I have a client side application that uses Kerberos authentication to connect to remote service. When reseting the password for the SPN in ADSI without renewing the ticket, the authentication fails (of course). The question is, if there is a way to know in advance that the ticket is not valid\ expired.

Thanks!!

Answer 1

1. Call LsaCallAuthenticationPackage with the message type KerbQueryTicketCacheMessage.

2. Run over the returned KERB_QUERY_TKT_CACHE_RESPONSE Tickets[Index].EndTime and compare it with the current time (You can refer to the EndTime as a TimeStamp).

   • That's all.