From 76d1adb7a6fab0e6cf30fd4d93684c2c979512fd Mon Sep 17 00:00:00 2001
From: Nick Craig-Wood <nick@craig-wood.com>
Date: Thu, 30 Jul 2026 17:37:47 +0100
Subject: [PATCH] smb: fix Kerberos credentials being reloaded for every
 connection - fixes #9674

A new KerberosFactory was constructed for every dial, so the client,
error and ccache modification time caches it holds were discarded
after a single use. Every new SMB connection re-read the Kerberos
config, re-parsed the ccache and did a fresh KDC exchange.

Share a single factory so clients are cached across connections as
intended, and refreshed when the ccache file changes.
---
 backend/smb/connpool.go | 2 +-
 backend/smb/kerberos.go | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/backend/smb/connpool.go b/backend/smb/connpool.go
index e040881d9..aa2b0a178 100644
--- a/backend/smb/connpool.go
+++ b/backend/smb/connpool.go
@@ -38,7 +38,7 @@ func (f *Fs) dial(ctx context.Context, network, addr string) (*conn, error) {
 
 	d := &smb2.Dialer{}
 	if f.opt.UseKerberos {
-		cl, err := NewKerberosFactory().GetClient(f.opt.KerberosCCache)
+		cl, err := kerberosFactory.GetClient(f.opt.KerberosCCache)
 		if err != nil {
 			return nil, err
 		}
diff --git a/backend/smb/kerberos.go b/backend/smb/kerberos.go
index fdbb19ddd..eaebce931 100644
--- a/backend/smb/kerberos.go
+++ b/backend/smb/kerberos.go
@@ -33,6 +33,9 @@ type KerberosFactory struct {
 	loadConfig func() (*config.Config, error)
 }
 
+// kerberosFactory is the shared KerberosFactory used to cache all connections
+var kerberosFactory = NewKerberosFactory()
+
 // NewKerberosFactory creates a new instance of KerberosFactory with default dependencies.
 func NewKerberosFactory() *KerberosFactory {
 	return &KerberosFactory{