I'm trying to find ways to get rid of as much of my custom C coding as possible, since I may be the only one that can maintain it. One major one is renewd, which renews tgt's automatically.

sssd can now do this. However I also need to kill the tickets when the user is no longer active. This could be done in a fairly simple shell script, but only if I can find a list of current active credential caches. At the moment the only way I can see to do that is to use tdbdump on secrets.ldb. I'm probably going to try that, but I'd prefer a better approach.