Description of problem:
Python application based on python-krbV is leaking fds in /var/tmp/ directory named HTTP_XXX, until it eventually reaches 1024 limit and stops working.

After attaching gdb I could see that these are opened by ./src/lib/krb5/rcache/rc_io.c:krb5_rc_io_open_internal()

After digging a bit further I found following code at ./src/lib/krb5/krb/rd_req_dec.c:rd_req_decoded_opt() which seems to be responsible for opening this fd, when KRB5_AUTH_CONTEXT_DO_TIME flag is present:
------------------------------------------------------------------------------
   if (((*auth_context)->rcache == NULL)
        && ((*auth_context)->auth_context_flags & KRB5_AUTH_CONTEXT_DO_TIME)
        && server) {
        if ((retval = krb5_get_server_rcache(context, krb5_princ_component(context,server,0), &(*auth_context)->rcache)))
------------------------------------------------------------------------------
fd opened in this way ^^ doesn't seem to be ever closed.

One workaround I found is to create/attach rcache to AuthContext explicitly, then problem goes away.

Version-Release number of selected component (if applicable):
krb5-libs-1.10.3-42.el6.x86_64
krb5-libs-1.10.3-42.el6.i686
krb5-devel-1.10.3-42.el6.x86_64
krb5-debuginfo-1.10.3-42.el6.x86_64
krb5-workstation-1.10.3-42.el6.x86_64
python-krbV-1.0.90-3.el6.x86_64

How reproducible:
100%

Steps to Reproduce:
Make an rd_req() call where AuthContext has KRB5_AUTH_CONTEXT_DO_TIME flag set and at same time it doesn't set any rcache via krb5_auth_con_setrcache().
(I'm sorry, but I don't have a reproducer in C.)

Actual results:
rcache fd is opened every time rd_req() is called when KRB5_AUTH_CONTEXT_DO_TIME flag is present and there's no rcache attached to AuthContext.

Expected results:
rcache fds should not pile up

Additional info:
https://git.fedorahosted.org/cgit/python-krbV.git

This is what python source on server side looks like:
------------------------------------------------------------------------------
    def login_krbv(self, krb_request, remote_addr):
        context = krbV.default_context()
        principal = self.krb_auth_principal
        keytabfile = self.krb_auth_keytabfile

        server_principal = krbV.Principal(name = principal, context = context)
        server_keytab = krbV.Keytab(name = keytabfile, context = context)

        auth_context = krbV.AuthContext(context = context)
        auth_context.flags = (krbV.KRB5_AUTH_CONTEXT_DO_SEQUENCE |
                              krbV.KRB5_AUTH_CONTEXT_DO_TIME)

        hostname = principal.split("/")[1]

        auth_context.addrs = (socket.gethostbyname(hostname), 0,
                              socket.gethostbyname(remote_addr), 0)

        # decode and read the authentication request
        decoded_request = base64.decodestring(krb_request)
        auth_tuple = context.rd_req(decoded_request,
                               server = server_principal,
                               keytab = server_keytab,
                               auth_context = auth_context,
                               options = krbV.AP_OPTS_MUTUAL_REQUIRED)
        auth_context, opts, server_principal, cache_credentials = auth_tuple
        cprinc = cache_credentials[2]

        # remove @REALM and return username
        return cprinc.name.split("@")[0]
------------------------------------------------------------------------------

And the workaround is:
------------------------------------------------------------------------------
diff --git a/server/autobkr/server/auth.py b/server/autobkr/server/auth.py
index 9ec9f203ba9e..c18027a0ab25 100644
--- a/server/autobkr/server/auth.py
+++ b/server/autobkr/server/auth.py
@@ -38,6 +38,8 @@ class KrbAuth():
         auth_context = krbV.AuthContext(context = context)
         auth_context.flags = (krbV.KRB5_AUTH_CONTEXT_DO_SEQUENCE |
                               krbV.KRB5_AUTH_CONTEXT_DO_TIME)
+        auth_context.rcache = context.default_rcache()
+
         hostname = principal.split("/")[1]
------------------------------------------------------------------------------