On Thu, 2013-02-28 at 09:43 -0500, Qing Chang wrote:
other than using kinit -r afterwards, how can sssd/pam be configured
to invoke kinit -r
Before migrated to IPA, I install kstart for kerberos clients and run krenew -K 60 to
krenew checking every 60 minutes in the background to extend ticket when due to expire.
It does not work with IPA client because it seems IPA client can not obtain a renewable
ticket by default at login. Can this be changed?
Look at the sssd-krb5 man page there is a krb5_renewable_lifetime option
in there that should do what you asked for.
Simo Sorce * Red Hat, Inc * New York