ORPHEUS' LYRE

As it happened, Viktor and Nico were researching a bug involving a Two Sigma-specific feature they added to Heimdal. The bug involved confusion in the "non-referrals" codepath in Heimdal for talking to the KDC, whereby a referral was treated as a non-referral. This was funny because we had been under the impression that "referral TGTs" should not be stored in the local ticket cache, and yet that was happening anyways. This forced us to re-examine everything we knew about referrals in the Kerberos protocol. Jeff and Nico each have nearly two decades of experience with Kerberos, while Viktor is not as expert in Kerberos, but extremely inquisitive. We worked through everything. We questioned the "canonicalization" extension in the Kerberos protocol. It took us an hour or so to realize that there was a serious bug here.