Hi,
I am using sssd to renew my kerberos keys every 2 minutes (I know this is short, but it's for testing to see if it actually works). I aslo set the lifetime of my kerberos tickets to 10 minutes. I verified that sssd is infact renewing the keys on the interval
i specified, because when i "klist" i see the valid starting time change, however when i try to access the share it no longer works.
Here is some output:
tbeaudry@perf-hpc01:~$ date
Thu Sep 29 10:19:29 EDT 2016
tbeaudry@perf-hpc01:~$ klist
Ticket cache: FILE:/usr/krb5/creds/.krb5cache_1624330994
Default principal: tbeaudry@CONCORDIA.CA
Valid starting Expires Service principal
2016-09-29 10:18:54 2016-09-29 10:28:54 krbtgt/CONCORDIA.CA@CONCORDIA.CA
renew until 2016-10-06 10:12:54
tbeaudry@perf-hpc01:~$ cd ~
-bash: cd: /NAS/home/tbeaudry: Key has expired
From my krb5.conf
[libdefaults]
default_realm = CONCORDIA.CA
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 10m
renew_lifetime = 7d
From my sssd.conf
[domain/concordia.ca]
ad_domain = concordia.ca
krb5_realm = CONCORDIA.CA
realmd_tags = manages-system joined-with-adcli
cache_credentials = True
id_provider = ad
krb5_store_password_if_offline = True
default_shell = /bin/bash
ldap_id_mapping = True
#use_fully_qualified_names = True
override_homedir = /NAS/home/%u
fallback_homedir = /home/%u
access_provider = ad
debug_level=7
ignore_group_members=True
krb5_renewable_lifetime = 7d
krb5_renew_interval = 2m
Thanks!
Thomas