Mail and Kerberos problem

Question

Mail client: 10.7.4
Mail server: 10.6.8
Mail protocol: imap
Authentication: Kerberos V5
The problem: when I login on my client, a TGT is acquired normally, klist shows it, and if I launch Mail, mail get a imap service ticket and all works fine.
When my TGT expires, I cannot get a new TGT otherwise than a kinit, which is unacceptable for my users. Before, whith Snow Leopard or Leopard mail client, if no TGT was present on client, mail poped up a specific kerberos dialog box to ask the password and then get a new TGT and imap service ticket. It is anyway the actual behavior with others services as AFP for example.
I have try to create an user Launch Agent which make a kinit periodically, but when the Mac client get out of long sleep state, the TGT is expired and I have no way to launch my script at this moment.
To reproduce the problem with no ticket at sequence start:
foo-mac1:~ foo$ klist
klist: krb5_cc_get_principal: No credentials cache file found
foo-mac1:~ foo$ kinit  kinit [email protected]
foo-mac1:~ foo$ klist
Credentials cache: API:501:12
        Principal: [email protected]
  Issued           Expires          Principal
Jul  5 10:41:50  Jul  5 20:41:50  krbtgt/[email protected]
A this point, I launch Mail, a service ticket is created, my account is connected and well working.
foo-mac1:~ foo$ klist
Credentials cache: API:501:12
        Principal: foo@XSERVER1. MYDOMAIN.NET
  Issued           Expires          Principal
Jul  5 10:41:50  Jul  5 20:41:50  krbtgt/XSERVER1. MYDOMAIN.NET@XSERVER1. MYDOMAIN.NET
Jul  5 11:01:22  Jul  5 20:41:50  imap/xserver3.mydomain.net@XSERVER1. MYDOMAIN.NET
I quit mail and delete my TGT.
foo-mac1:~ foo$ kdestroy
foo-mac1:~ foo$ klist
klist: krb5_cc_get_principal: No credentials cache file found
If I launch Mail, my account cannot connect and does not propose password dialog as precedent versions so I cannot re-create TGT and imap service ticket otherwise than kinit.
moreover, Mail log a logic entry:
03/07/12 17:04:52,838 Mail: GSSAPI Error:  Miscellaneous failure (see text (No credentials cache file found (negative cache))
03/07/12 17:04:52,838 Mail: [<_LibSasl2SASLClient: 0x7f951dd4f080> mechanism: GSSAPI security layer: no] Failed to start the SASL connection
SASL(-1): generic failure: GSSAPI Error:  Miscellaneous failure (see text (No credentials cache file found (negative cache))
Do you have an idea to make Mail propose an user friendly dialog box when TGT expires or do you have an idea to launch a script when a Mac get out of sleep?

Answer 1

No solution at this point. Now we are seeing the same problem trying to authenticate radius users. Extremely frustrating!
/var/log/system.log:
Sep 19 11:22:58 hostname /usr/sbin/PasswordService[54]: wrong-sized secret 32
Sep 19 11:22:58 hostname /usr/sbin/PasswordService[54]: Unexpected State Reached in MS-CHAPv2 plugin
Sep 19 11:24:05 hostname /usr/sbin/PasswordService[54]: wrong-sized secret 32
Sep 19 11:24:05 hostname /usr/sbin/PasswordService[54]: Unexpected State Reached in MS-CHAPv2 plugin
Sep 19 11:26:27 hostname /usr/sbin/PasswordService[54]: wrong-sized secret 32
Sep 19 11:26:27 hostname /usr/sbin/PasswordService[54]: Unexpected State Reached in MS-CHAPv2 plugin
/var/log/radius/radius.log:
Fri Sep 19 14:21:56 2008 : Error: rlm_mschap: authentication failed -14090
Fri Sep 19 14:28:31 2008 : Auth: rlm_opendirectory: Could not get the user's uuid.
Fri Sep 19 14:28:31 2008 : Auth: rlm_opendirectory: Could not get the user's uuid.
Fri Sep 19 14:28:31 2008 : Auth: rlm_opendirectory: Could not get the user's uuid.
Fri Sep 19 14:28:48 2008 : Auth: rlm_opendirectory: Could not get the user's uuid.
I'm wondering if it's trying to use the wrong auth mech at first. I see the user come in with a successful DIGEST-MD5 during the problem, then successful MS-CHAPv2 following the password reset. Resetting the user's password "fixes" the issue. Until it happens again at an unspecified time.