On 27/04/13 17:39, Simo Sorce wrote:
On Sat, 2013-04-27 at 10:46 +0200, steve wrote:
> On 27/04/13 03:54, Simo Sorce wrote:
>> On Sat, 2013-04-27 at 00:44 +0200, steve wrote:
>>> Hi
>>> 1.9.4 Ubuntu 13.04
>>>
>>> We have this in sssd.conf:
>>>
>>> ldap_sasl_mech = gssapi
>>> ldap_sasl_authid = HH16$
>>> ldap_krb5_keytab = /etc/krb5.keytab
>>> ldap_krb5_init_creds = true
>>>
>>> but no krb5cc_xxxx file appears in /tmp when we start sssd
>>>
>>> This works OK with openSUSE with te same config.
>>>
>>> How can we get sssd to produce the cache file as expected?
>> The ccache file for sssd itself is in /var/lib/sss/db/ccache_<REALM>
>>
>> Simo.
>>
>> Hi
>> Thanks, but:
>> klist -k ccache_HH3.SITE
>> Keytab name: FILE:ccache_HH3.SITE
this is ^^not^^ a keytab (-k) it's a ccache.
Just do klist ccache_HH3.SITE
Yes. I feel so stupid. It's not recognised
though. Other apps expect it
to be under /tmp and be called krb5cc_0
>> klist: Unsupported key table format version number while starting keytab scan
>>
>> So I can't use it for anything else. Is it possible for sssd to produce a
cache that klist understands so I can reuse it as the root cache for other processes?
You may be interested in the gss-proxy project if you need to use keys
for other components and need a ccache to be generated on the fly for
you. (works only with MIT kerberos starting on Fedora 19)
Sounds good. We need the
cache for automounted cifs from Samba. We need
the root cache at /tmp/krb5cc_0. As it stands, I have to maintain the
cache using a cron or by using k5start, which is a pain. I thought that
as sssd is constantly in play, it could be used to maintain the cache.
Any idea if I could symlink it from its sssd location to /tmp? BTW, the
root cache can hold any principal. The MACHINE$ key we use for sss would
be fine.
>> We have a Samba4 KDC
I know very well, hello group-steve :-)
Simo.
Yes, of course, that's why the name Simo seems familiar, from the samba
lists. Samba4 + sssd: Amazing technology.