[SSSD] krb5 ticket renewal via gnome-screensaver not working

Simo Sorce ssorce at redhat.com
Sun Nov 8 01:02:40 UTC 2009


On Sat, 2009-11-07 at 15:32 -0500, Brian J. Murrell wrote:
> I've got SSSD 0.7.1 installed on a laptop here for my wife.  She
> authenticates with kerberos on that laptop via sssd.
> 
> So, when she first logs in, sssd manages to get her a tgt and everything
> is good.  However when gnome-screensaver locks her screen and she uses
> her (kerberos of course) password to unlock it, there does not seem to
> be any tgt renewal happening like it did with pam_krb5.so.
> 
> Have I configured something incorrectly?  The domain I created for
> kerberos looks like:
> 
> [domain/KRB]
> auth_provider = krb5
> cache_credentials = true
> enumerate = true
> id_provider = ldap
> chpass_provider = krb5
> 
> ldap_uri = ldap://ldap
> ldap_user_search_base = ou=People,dc=interlinx,dc=bc,dc=ca
> ldap_group_search_base = ou=Group,dc=interlinx,dc=bc,dc=ca
> tls_reqcert = demand
> ldap_tls_cacert = /etc/pki/tls/certs/ca-bundle.crt
> 
> krb5_kdcip = 10.75.22.3
> krb5_realm = ILINX
> krb5_changepw_principle = kadmin/changepw
> krb5_ccachedir = /tmp
> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
> krb5_auth_timeout = 15
> 
> Have I done something incorrectly?

It should work, any chance you can check if this fails to work with
master as well ?
Otherwise just open a bug and we will verify asap.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list