From 24f05cf9b9b6bd9c57d09dbd018da179eb8dc8bb Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Aug 19 2014 11:27:07 +0000
Subject: Fix ticket expiration check.


https://fedorahosted.org/bind-dyndb-ldap/ticket/131

Signed-off-by: Petr Spacek <pspacek@redhat.com>

---

diff --git a/src/krb5_helper.c b/src/krb5_helper.c
index d178720..169d384 100644
--- a/src/krb5_helper.c
+++ b/src/krb5_helper.c
@@ -78,8 +78,10 @@ check_credentials(krb5_context context,
 
 	krberr = krb5_timeofday(context, &now);
 	CHECK_KRB5(context, krberr, "Failed to get timeofday");
+	log_debug(2, "krb5_timeofday() = %u ; creds.times.endtime = %u",
+		  now, creds.times.endtime);
 
-	if (now > (creds.times.endtime + MIN_TIME)) {
+	if (now > (creds.times.endtime - MIN_TIME)) {
 		log_debug(2, "Credentials in cache expired");
 		result = ISC_R_FAILURE;
 		goto cleanup;