On (10/11/15 12:10), Joschi Brauchle wrote:
I will provide more logs shortly. Just one quick question:
I updates to Ubuntu 15.10 (latest) and all problems persist if I dont use
FILE based caches.
I then checked the installed packages in Ubuntu and to my surpise, I found a
mixed setup with MIT kerberos and Heimdal Kerberos libraries. E.g. the
openLDAP service and all Samba tools use heimdal, whereas the rest of the
system uses MIT kerberos libs.
So, I am starting to believe that the problems I see are coming from this
mixture of kerberos libs.
E.g., when I use DIR ccaches as default in /etc/krb5.conf and then remove the
KRB5CCNAME variable in my session, all MIT-based kerberos tools still work
(because they read the setup correctly from /etc/krb5.conf) while all Samba
tools fail and use /tmp/ to check for FILE caches.
It could explain a lot.
You might try to remove default_ccache_name from /etc/krb5.conf
and still use KEYRING ccache.
You just need to set krb5_ccname tepmplate in domain section of sssd.
man sssd-krb5 -> krb5_ccname_template
BTW template default_ccache_name in krb5.conf and krb5_ccname_template in
sssd.conf have different syntax.
I didn't test it but it might help