On Oct 4, 2023, at 00:07, Lukas Slebodnik <lslebodn@redhat.com> wrote:
On (03/10/23 21:15), Francis Augusto Medeiros-Logeay wrote:
Hi,
We had a mechanism to allow users to mount their directory by using a user systemd service that runs mount (with sudo).
Since we use kerberos on that operation, we’d add
Defaults env_keep += «KRB5CCNAME"
To a sudoers.d file.
This worked pretty well, but then we moved to KCM: instead of FILE:.
Is there a way we can preserve access to KCM tickets for a user when he uses sudo?
Ticket are preserved.
But sssd-kcm generate "search path" based on connected client
and if you run it with sudo UID changes e.g.
```
sh$ KRB5CCNAME=KCM:1000:35443 klist -l
Principal name Cache name
-------------- ----------
lslebodn@FEDORAPROJECT.ORG KCM:1000:35443 (Expired)
```
and now with sudo
```
sh$ KRB5CCNAME=KCM:1000:35443 sudo --preserve-env=KRB5CCNAME klist -l
Principal name Cache name
-------------- ----------
```
Thanks a lot Lukas!
I wonder how we can fill up KRB5CCNAME. I have the feeling that this is filled up automatically when FILE: is used (with /tmp/krb5ccnamexxx, for example). But with KCM I just get an empty KCM: with the variable. Is this something I can configure on krb5.conf?
Best,
Francis