kerberos on-disk cache corrupts or causes problems

[yoshi314]

Describe the bug
I have modified the provided wmic_server.py as follows

+from aiowmi.kerberos.cache import KerberosCache


(...) 
kcache = KerberosCache('some_file.bin')
conn = Connection(host, username, password, domain=domain, kerberos_cache = kcache, kdc_host = '172.17.0.101')


(...) 
-            service = await conn.negotiate_ntlm()
+            service = await conn.negotiate_kerberos()

Things work within first few queries, but soon i am starting to hit

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)

To Reproduce
Steps to reproduce the behavior:

1. Use kerberos authentication and on-disk cache file
2. Do different queries on one server, or use alternating users for queries.
3. Observe errors
4. As soon as cache file is deleted everything starts temporarily working again.

Using in-memory kcache doesn't seem to exhibit any issues.

Expected behavior
Queries work all the time on multiple users.

Additional context

This is a use-case with per-use kcache files

 ==== user 2 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:32:58 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:32:59 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1442

[{"Caption": "Intel64 Family 6 Model 63 Stepping 2", "Description": "Intel64 Family 6 Model 63 Stepping 2", "InstallDate": "", "Name": "Intel(R) Xeon(R) CPU E5-2698 v3 @ 2.30GHz", "Status": "OK", "Availability": 3, "CreationClassName": "Win32_Processor", "ConfigManagerErrorCode": 0, "ConfigManagerUserConfig": true, "DeviceID": "CPU0", "PowerManagementCapabilities": [], "PNPDeviceID": "", "PowerManagementSupported": true, "StatusInfo": 3, "SystemCreationClassName": "Win32_ComputerSystem", "SystemName": "LUBSDCA01", "LastErrorCode": 0, "ErrorDescription": "", "ErrorCleared": true, "AddressWidth": 64, "CurrentClockSpeed": 2297, "DataWidth": 64, "Family": 65535, "OtherFamilyDescription": "", "LoadPercentage": 16, "MaxClockSpeed": 2297, "Role": "CPU", "UpgradeMethod": 6, "Stepping": "", "UniqueId": "", "Version": "", "Manufacturer": "GenuineIntel", "L2CacheSize": 0, "L2CacheSpeed": 0, "L3CacheSize": 0, "L3CacheSpeed": 0, "Architecture": 9, "Level": 6, "Revision": 16130, "CpuStatus": 1, "CurrentVoltage": 0, "ExtClock": 0, "ProcessorId": "0000000000000000", "ProcessorType": 3, "NumberOfLogicalProcessors": 4, "NumberOfCores": 4, "SocketDesignation": "None", "VoltageCaps": 0, "VMMonitorModeExtensions": false, "SecondLevelAddressTranslationExtensions": false, "VirtualizationFirmwareEnabled": false, "SerialNumber": "None", "AssetTag": "None", "PartNumber": "None", "NumberOfEnabledCore": 4, "ThreadCount": 1, "Characteristics": 0}]
 ==== user 2 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 144

[{"Year": 2026, "Month": 4, "Day": 3, "DayOfWeek": 5, "WeekInMonth": 1, "Quarter": 2, "Hour": 12, "Minute": 33, "Second": 4, "Milliseconds": 0}]
 ================ time checks =================
 ==== user 2 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 1 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 2 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 1 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:33:04 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)

This is with singular kcache file for all users, first user has no access to first server and that causes all subsequent attempts on all users to fail.

 ==== user 2 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:32 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:32 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 230

Problem with the wmi query on the target host. --- MSRPC BIND_NAK ---
Call ID         : 1
Provider Reason : Unknown (9)
Windows Status  : 0x0501 -> RPC_S_PROTSEQ_NOT_SUPPORTED (Security flags denied)
------------------------------
 ==== user 2 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 230

Problem with the wmi query on the target host. --- MSRPC BIND_NAK ---
Call ID         : 1
Provider Reason : Unknown (9)
Windows Status  : 0x0501 -> RPC_S_PROTSEQ_NOT_SUPPORTED (Security flags denied)
------------------------------
 ================ time checks =================
 ==== user 2 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 1 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 2 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)
 ==== user 1 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:34:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 73

Problem with the wmi query on the target host. RPC_S_SEC_PKG_ERROR (1825)

this one is with kcache = KerberosCache()

 ==== user 2 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:37 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 cpu sdca
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:38 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1442

[{"Caption": "Intel64 Family 6 Model 63 Stepping 2", "Description": "Intel64 Family 6 Model 63 Stepping 2", "InstallDate": "", "Name": "Intel(R) Xeon(R) CPU E5-2698 v3 @ 2.30GHz", "Status": "OK", "Availability": 3, "CreationClassName": "Win32_Processor", "ConfigManagerErrorCode": 0, "ConfigManagerUserConfig": true, "DeviceID": "CPU0", "PowerManagementCapabilities": [], "PNPDeviceID": "", "PowerManagementSupported": true, "StatusInfo": 3, "SystemCreationClassName": "Win32_ComputerSystem", "SystemName": "LUBSDCA01", "LastErrorCode": 0, "ErrorDescription": "", "ErrorCleared": true, "AddressWidth": 64, "CurrentClockSpeed": 2297, "DataWidth": 64, "Family": 65535, "OtherFamilyDescription": "", "LoadPercentage": 52, "MaxClockSpeed": 2297, "Role": "CPU", "UpgradeMethod": 6, "Stepping": "", "UniqueId": "", "Version": "", "Manufacturer": "GenuineIntel", "L2CacheSize": 0, "L2CacheSpeed": 0, "L3CacheSize": 0, "L3CacheSpeed": 0, "Architecture": 9, "Level": 6, "Revision": 16130, "CpuStatus": 1, "CurrentVoltage": 0, "ExtClock": 0, "ProcessorId": "0000000000000000", "ProcessorType": 3, "NumberOfLogicalProcessors": 4, "NumberOfCores": 4, "SocketDesignation": "None", "VoltageCaps": 0, "VMMonitorModeExtensions": false, "SecondLevelAddressTranslationExtensions": false, "VirtualizationFirmwareEnabled": false, "SerialNumber": "None", "AssetTag": "None", "PartNumber": "None", "NumberOfEnabledCore": 4, "ThreadCount": 1, "Characteristics": 0}]
 ==== user 2 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:43 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 80

Problem with the wmi query on the target host. WBEM_E_ACCESS_DENIED (2147749891)
 ==== user 1 sdca time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:43 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 145

[{"Year": 2026, "Month": 4, "Day": 3, "DayOfWeek": 5, "WeekInMonth": 1, "Quarter": 2, "Hour": 12, "Minute": 35, "Second": 43, "Milliseconds": 0}]
 ================ time checks =================
 ==== user 2 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:43 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 145

[{"Year": 2026, "Month": 4, "Day": 3, "DayOfWeek": 5, "WeekInMonth": 1, "Quarter": 2, "Hour": 12, "Minute": 35, "Second": 43, "Milliseconds": 0}]
 ==== user 1 strm time
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:43 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 145

[{"Year": 2026, "Month": 4, "Day": 3, "DayOfWeek": 5, "WeekInMonth": 1, "Quarter": 2, "Hour": 12, "Minute": 35, "Second": 43, "Milliseconds": 0}]
 ==== user 2 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:44 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1455

[{"Caption": "Intel64 Family 6 Model 79 Stepping 1", "Description": "Intel64 Family 6 Model 79 Stepping 1", "InstallDate": "", "Name": "Intel(R) Xeon(R) CPU E5-2667 v4 @ 3.20GHz", "Status": "OK", "Availability": 3, "CreationClassName": "Win32_Processor", "ConfigManagerErrorCode": 0, "ConfigManagerUserConfig": true, "DeviceID": "CPU0", "PowerManagementCapabilities": [], "PNPDeviceID": "", "PowerManagementSupported": true, "StatusInfo": 3, "SystemCreationClassName": "Win32_ComputerSystem", "SystemName": "LUBSTRMDC22S", "LastErrorCode": 0, "ErrorDescription": "", "ErrorCleared": true, "AddressWidth": 64, "CurrentClockSpeed": 3196, "DataWidth": 64, "Family": 179, "OtherFamilyDescription": "", "LoadPercentage": 35, "MaxClockSpeed": 3196, "Role": "CPU", "UpgradeMethod": 43, "Stepping": "", "UniqueId": "", "Version": "", "Manufacturer": "GenuineIntel", "L2CacheSize": 2048, "L2CacheSpeed": 0, "L3CacheSize": 25600, "L3CacheSpeed": 0, "Architecture": 9, "Level": 6, "Revision": 20225, "CpuStatus": 1, "CurrentVoltage": 18, "ExtClock": 100, "ProcessorId": "BFEBFBFF000406F1", "ProcessorType": 3, "NumberOfLogicalProcessors": 16, "NumberOfCores": 8, "SocketDesignation": "Proc 1", "VoltageCaps": 0, "VMMonitorModeExtensions": false, "SecondLevelAddressTranslationExtensions": false, "VirtualizationFirmwareEnabled": false, "SerialNumber": "", "AssetTag": "UNKNOWN", "PartNumber": "", "NumberOfEnabledCore": 8, "ThreadCount": 16, "Characteristics": 252}]
 ==== user 1 cpu strmdc
HTTP/1.1 200 OK
Server: gunicorn
Date: Fri, 03 Apr 2026 12:35:45 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 1455

[{"Caption": "Intel64 Family 6 Model 79 Stepping 1", "Description": "Intel64 Family 6 Model 79 Stepping 1", "InstallDate": "", "Name": "Intel(R) Xeon(R) CPU E5-2667 v4 @ 3.20GHz", "Status": "OK", "Availability": 3, "CreationClassName": "Win32_Processor", "ConfigManagerErrorCode": 0, "ConfigManagerUserConfig": true, "DeviceID": "CPU0", "PowerManagementCapabilities": [], "PNPDeviceID": "", "PowerManagementSupported": true, "StatusInfo": 3, "SystemCreationClassName": "Win32_ComputerSystem", "SystemName": "LUBSTRMDC22S", "LastErrorCode": 0, "ErrorDescription": "", "ErrorCleared": true, "AddressWidth": 64, "CurrentClockSpeed": 3196, "DataWidth": 64, "Family": 179, "OtherFamilyDescription": "", "LoadPercentage": 21, "MaxClockSpeed": 3196, "Role": "CPU", "UpgradeMethod": 43, "Stepping": "", "UniqueId": "", "Version": "", "Manufacturer": "GenuineIntel", "L2CacheSize": 2048, "L2CacheSpeed": 0, "L3CacheSize": 25600, "L3CacheSpeed": 0, "Architecture": 9, "Level": 6, "Revision": 20225, "CpuStatus": 1, "CurrentVoltage": 18, "ExtClock": 100, "ProcessorId": "BFEBFBFF000406F1", "ProcessorType": 3, "NumberOfLogicalProcessors": 16, "NumberOfCores": 8, "SocketDesignation": "Proc 1", "VoltageCaps": 0, "VMMonitorModeExtensions": false, "SecondLevelAddressTranslationExtensions": false, "VirtualizationFirmwareEnabled": false, "SerialNumber": "", "AssetTag": "UNKNOWN", "PartNumber": "", "NumberOfEnabledCore": 8, "ThreadCount": 16, "Characteristics": 252}]

So, it does appear that first connection failure does something to the cache and breaks all subsequent connections. Using in-memory kcache doesn't exhibit the problem, and likely not using it at all also would have no problems.

[joente]

You need a kerberos cache file per connection so each authentication uses it's own cache. Most likely the latest version would allow you to connect as this does a retry for when a cache is not accepted by the server, but then the cache would not work as you would want.

[yoshi314]

per connnection, you mean - per server? if so i am pretty sure that i also had problems with that approach, but i'll retest that tomorrow.