[SSSD] krb5 ticket renewal via gnome-screensaver not working

Brian J. Murrell brian at interlinx.bc.ca
Mon Nov 9 14:29:44 UTC 2009


On Mon, 2009-11-09 at 15:13 +0100, Sumit Bose wrote: 
> 
> This error indicates a short write.

Ahhh.  Now that is meaningful to me.  :-)

> Can you check if a ccache file is
> create at all and if yes check the content with klist?

I didn't realize it was the ccache it was complaining about and I
thought it was sssd's internal caching (i.e. for disconnected use) that
it was complaining about.

It turns out that / (where /tmp lives) is full -- filled up with a
stupid $&@# "flash" file, and PDFs even.  Why is this crap being created
in /?  This is all ~/tmp/ fodder.  Hrm.  Now that I think of it, I
wonder if I really want /var/tmp for my krb5_ccachedir.

Anyway, creating some space in /tmp resolved the caching failure.

I also notice that I have:

krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX

Which I got from the example template.  Do I really want a unique ccache
for each logged instance of a single user?

So, back to testing gnome-screensaver and ccache refreshing... In my
efforts to clean up /tmp, I simply removed all of the krb5cc files for
the desktop user, so no ccache files at all.  I then unlocked the
screensaver and there was no new ccache file created.  A klist from that
desktop user yields:

klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_1001_mk7UxQ)

Surely, if gnome-screensaver's calling of pam_sssd were refreshing the
ccache, in this case it would have re-created it, yes?

b.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20091109/7ae4b808/attachment.sig>


More information about the sssd-devel mailing list