{
// Deny RENEWABLE tickets in policy.
config.setPaEncTimestampRequired( false );
config.setRenewableAllowed( false );
RequestBodyModifier modifier = new RequestBodyModifier();
modifier.setClientName( getPrincipalName( "hnelson" ) );
modifier.setServerName( getPrincipalName( "krbtgt/EXAMPLE.COM@EXAMPLE.COM" ) );
modifier.setRealm( "EXAMPLE.COM" );
modifier.setEType( config.getEncryptionTypes() );
KdcOptions kdcOptions = new KdcOptions();
kdcOptions.set( KdcOptions.RENEWABLE );
modifier.setKdcOptions( kdcOptions );
long now = System.currentTimeMillis();
KerberosTime requestedEndTime = new KerberosTime( now + 1 * KerberosTime.DAY );
modifier.setTill( requestedEndTime );
KerberosTime requestedRenewTillTime = new KerberosTime( now + KerberosTime.WEEK / 2 );
modifier.setRtime( requestedRenewTillTime );
KdcRequest message = new KdcRequest( KerberosConstants.KERBEROS_V5, KerberosMessageType.AS_REQ, null, modifier.getRequestBody() );
handler.messageReceived( session, message );
ErrorMessage error = ( ErrorMessage ) session.getMessage();
assertEquals( "KDC policy rejects request", 12, error.getErrorCode() );