If you take a look at src/mit-internals.h you'll see that the code copies internals from MIT Kerberos 1.3 to try and disable the replay cache. Unfortunately, the replay cache was refactored in ersion 1.18, and these internals no longer build. There's a "fix" to this in ticket 61, but that fix introduces a memory leak and replaces one set of internals with another. At this point I am fairly sure that the actual default replay cache should work, even against Microsoft authenticators, so we could simply remove the internals completely and use the default replay cache.
It might be better to disable things. That can be done with a setenv call, but that's undesirable in a apache module. I'm not remembering off the top of my head whether there's a better way to do this at the gss layer.
I replaced the patch in ticket #61 with this instead(quite some time ago):
```
--- ./src/mod_auth_kerb.c.org 2020-08-13 17:30:15.901691505 +0200
+++ ./src/mod_auth_kerb.c 2020-08-13 17:35:00.069621299 +0200
@@ -2062,6 +2062,11 @@
static int
have_rcache_type(const char *type)
{
return 1;
+#if 0
krb5_error_code ret;
krb5_context context;
krb5_rcache id = NULL;
@@ -2079,6 +2084,7 @@
krb5_free_context(context);
return found;
+#endif
}
/***********