From 80f7663f309c0d0b9cb89ed8f8b38301b207360d Mon Sep 17 00:00:00 2001
From: Petr Spacek <pspacek@redhat.com>
Date: Aug 13 2014 10:12:56 +0000
Subject: Fix ticket expiration check.


https://fedorahosted.org/bind-dyndb-ldap/ticket/131

Signed-off-by: Petr Spacek <pspacek@redhat.com>

---

diff --git a/src/krb5_helper.c b/src/krb5_helper.c
index 25de7f8..87a4934 100644
--- a/src/krb5_helper.c
+++ b/src/krb5_helper.c
@@ -77,8 +77,10 @@ check_credentials(krb5_context context,
 
 	krberr = krb5_timeofday(context, &now);
 	CHECK_KRB5(context, krberr, "Failed to get timeofday");
+	log_debug(2, "krb5_timeofday() = %u ; creds.times.endtime = %u",
+		  now, creds.times.endtime);
 
-	if (now > (creds.times.endtime + MIN_TIME)) {
+	if (now > (creds.times.endtime - MIN_TIME)) {
 		log_debug(2, "Credentials in cache expired");
 		result = ISC_R_FAILURE;
 		goto cleanup;