RHEL7 w/ sssd 1.13.0-40.el7_2.2. Connecting via SSH from PuTTY from a Windows box. GSSAPI is set up and also configured to allow credential delegation. When I connect, I am not prompted for a password and get into the system just fine.
However, klist shows nothing in my credential cache:
$ klist klist: Credentials cache file '/tmp/krb5cc_1766242567' not found
(I also see no other differently named krb5cc file under /tmp).
If I first SSH into a host runing winbind from the same PuTTY, I properly get a cached ticket there and can then ssh to the RHEL7 host and the ticket is properly forwarded across (klist shows it in the output).
$ klist Ticket cache: FILE:/tmp/krb5cc_1766242567_CMtqGFX6EG Default principal: username@DOMAIN.COM
Valid starting Expires Service principal 04/20/2016 20:57:41 04/21/2016 03:04:48 krbtgt/DOMAIN.COM@DOMAIN.COM renew until 04/27/2016 17:04:48
Have run sssd in foreground w/ debug and looked for krb5 message, but not even seeing it attempt to create or use ccache.
Figured someone here might be able to set me down the right course?
Thanks in advance.
Ray
My sssd.conf:
[sssd] config_file_version = 2 domains = domain.com services = nss, pam debug_level = 0 override_space = _ [nss] debug_level = 0 override_shell = /bin/bash allowed_shells = /bin/bash, /bin/tcsh vetoed_shells = /bin/csh shell_fallback = /bin/bash [pam] debug_level = 0 [domain/domain.com] debug_level = 0 id_provider = ad access_provider = ad ignore_group_members = true cache_credentials = True ldap_group_nesting_level = 5 ldap_idmap_range_min = 200000 ldap_idmap_range_max = 2000200000 ldap_idmap_range_size = 500000 krb5_realm = DOMAIN.COM override_homedir = /home/%u ldap_referrals = false #krb5_ccachedir = /tmp #krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX krb5_renewable_lifetime = 12h krb5_renew_interval = 1h krb5_store_password_if_offline = True
krb5.conf:
[logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log
[libdefaults] default_realm = DOMAIN.COM dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h renew_lifetime = 7d rdns = false forwardable = true #default_ccache_name =
[realms] DOMAIN.COM = { #kdc = kerberos.example.com #admin_server = kerberos.example.com }
[domain_realm] .domain.com = DOMAIN.COM domain.com = DOMAIN.COM