How to compare two dates in script to check expiration

Question

I am creating a script where I can check to see if something is expired such as a kerberos ticket cache.

I need to get the expiration date/time, get the current date/time, and compare them to see if this first date/time would be expired.

I am creating a script to see if a kerberos ticket is still valid, or expired.

I can get the expiration date+time for both in epoch format (assuming that is best).

KRBEXPDATE=$(klist | grep -i krbtgt | awk '{print $3}')
KRBEXPTIME=$(klist | grep -i krbtgt | awk '{print $4}')
CURREPOCH=$(date +%s)
KRBEXPEPOCH=$(date --date="$KRBEXPDATE $KRBEXPTIME" +%s)

I want to see if the kerberos ticket is expired in an if statement, I am having trouble with the logic on if statement working with time. I may have answered my own question here, but should it be CURRENTEPOCH is greater than KRBEXPEPOCH then echo "ticket is not valid". Does this make sense?

if [[ "$CURREPOCH" > "$KRBEXPEPOCH" ]] ;
then
  echo "Ticket is not valid"
fi

Answer 1

Comparing current date and expiration date, by converting them to seconds from epoch, is a good enough way of telling whether your ticket is expired or not. As long as you are obtaining CURREPOCH and KRBEXPEPOCH from the same host, you will be able to tell with good precision the current state of the ticket (if you don't get them from the same host, mind that the dates obtained may be relative to different time zones, and you would need to shift them accordingly).

However, as Kamil mentioned in his comment, the implementation you used in your answer has a crucial problem: as you can see in man bash, line 1753, the ">" operator compares strings. Which, for your application, is generally a wrong thing to do. To understand why, try this:

if [[ "1000" > "200" ]]; then
  echo "Statement is true"
else
  echo "Statement is false"
fi

As the number 1000 is in fact greater than 200, you might expect "Statement is true" to be printed out...but instead you get "Statement is false". That's because ">" acts like a strcmp(), comparing character-by-character the ASCII codes on the string (e.g. a < b would be true).

What you want to do is either use the "-gt" operator, like Kamil suggested, or compare them using bash's arithmetic expansion (which you can use in combination with if, as per man bash, line 270). Assuming you parsed the output of the klist command correctly, you can do either of these:

if [[ "$CURREPOCH" -gt "$KRBEXPEPOCH" ]]; then echo "expired"; fi
if (( $CURREPOCH > $KRBEXPEPOCH )); then echo "expired"; fi