title: Kerberos ticket "Expired"; Finding old, not new ticket
body: <p>I'm trying to get Kerberos connecting to a MS SQL database on my Mac (Big Sur).  I've been following instructions <a href="https://docs.microsoft.com/en-us/sql/azure-data-studio/enable-kerberos?view=sql-server-ver15" rel="nofollow noreferrer">here</a>.  My Kerberos authenticated connections used to work.  They stopped working when I tried them recently.  This <em>might</em> be due to upgrading the OS.</p>
  <p>Per the instructions, I have an <code>/etc/krb5.conf</code> file that looks something like this:</p>
  <pre><code>[libdefaults]
    default_realm = DOMAIN.COMPANY.COM
   
  [realms]
  DOMAIN.COMPANY.COM = {
     kdc = dc-33.domain.company.com
  }
  </code></pre>
  <p>When I go to my terminal and run <code>kinit username@DOMAIN.COMPANY.COM</code> it prompts me for my password.  After successfully entering my password, I immediately run the <code>klist</code> command, as recommended, and I'm getting something like this:</p>
  <pre><code>Credentials cache: API:1234A5B6-7C8D-9EF0-B1F9-ED757F2418F4
          Principal: username@DOMAIN.COMPANY.COM
  
    Issued                Expires        Principal
  Apr  5 09:02:23 2022  &gt;&gt;&gt;Expired&lt;&lt;&lt;  krbtgt/DOMAIN.COMPANY.COM@DOMAIN.COMPANY.COM
  </code></pre>
  <p>This looks like an old ticket/credential (I'm writing this April 8th) somewhere on my machine.  The old ticket is &quot;Expired&quot;.  Why isn't the klist command retrieving the recent <code>kinit</code> credential?  What would cause this?  How can I fix it?</p>
  <h2>Things I've tried</h2>
  <p>Naively, in the beginning of all of my Kerberos connectivity issues and before getting this error, I thought I needed to update/upgrade Kerberos.  So I installed Kerberos with <code>brew install krb5</code>.  Unfortunately, I think this just confused the OS because Kerberos was then installed in 2 locations.</p>
  <p>I saw that the operating system might need to &quot;know&quot; where to find Kerberos files if it gets confused (see above bullet point).  So, I added the following lines to my <code>.zshrc</code> file.</p>
  <pre><code>export PATH=/usr/local/opt/krb5/bin:$PATH
  export PATH=/usr/local/opt/krb5/sbin:$PATH
  export LDFLAGS=&quot;-L/usr/local/opt/krb5/lib $LDFLAGS&quot;
  export CPPFLAGS=&quot;-I/usr/local/opt/krb5/include $CPPFLAGS&quot;
  </code></pre>
  <p>These lines helped while I still had the Homebrew version of Kerberos installed, but I have since run <code>brew uninstall krb5</code> and now they don't help (see next paragraph).</p>
  <p>I did a search in my terminal for the <code>krb5</code> folder using this command <code>sudo find / -name &quot;krb5&quot;</code>.  When I searched through the long list of results, I found several <code>krb5</code> folders, but none of them had <code>bin</code>, <code>sbin</code>, <code>lib</code> or <code>include</code> directories in them.  So, it seems that during the <code>brew uninstall krb5</code> command those files were removed from my system as well as the files in <code>/usr/local/Cellar</code>.</p>
  <p>I haven't tried installing the &quot;Prerequisites&quot; on the <a href="https://docs.microsoft.com/en-us/sql/azure-data-studio/enable-kerberos?view=sql-server-ver15" rel="nofollow noreferrer">instruction page</a> yet, because my Kerberos used to work already in the past.  So, I'm assuming that the prerequisites should already be in place, unless they changed during my OS update.  I was hesitant to try that because of the issues the <code>brew install</code> attempt created.</p>
  <h2>Conclusion</h2>
  <p>It's obvious the Kerberos is still installed somewhere on my machine because it will prompt me to enter my password after <code>kinit</code> and knows if the password entered is valid or not.  The credentials are &quot;Expired&quot; immediately after being created.  How can I fix this?</p>