[SSSD] no krb5 cache produced

Simo Sorce simo at redhat.com
Sat Apr 27 15:39:12 UTC 2013


On Sat, 2013-04-27 at 10:46 +0200, steve wrote:
> On 27/04/13 03:54, Simo Sorce wrote:
> > On Sat, 2013-04-27 at 00:44 +0200, steve wrote:
> >> Hi
> >> 1.9.4 Ubuntu 13.04
> >>
> >> We have this in sssd.conf:
> >>
> >> ldap_sasl_mech = gssapi
> >> ldap_sasl_authid = HH16$
> >> ldap_krb5_keytab = /etc/krb5.keytab
> >> ldap_krb5_init_creds = true
> >>
> >> but no krb5cc_xxxx file appears in /tmp  when we start sssd
> >>
> >> This works OK with openSUSE with te same config.
> >>
> >> How can we get sssd to produce the cache file as expected?
> >
> > The ccache file for sssd itself is in /var/lib/sss/db/ccache_<REALM>
> >
> > Simo.
> >
> > Hi
> > Thanks, but:
> > klist -k ccache_HH3.SITE
> > Keytab name: FILE:ccache_HH3.SITE

this is ^^not^^ a keytab (-k) it's a ccache.
Just do klist ccache_HH3.SITE

> > klist: Unsupported key table format version number while starting keytab scan
> >
> > So I can't use it for anything else. Is it possible for sssd to produce a cache that klist understands so I can reuse it as the root cache for other processes?

You may be interested in the gss-proxy project if you need to use keys
for other components and need a ccache to be generated on the fly for
you. (works only with MIT kerberos starting on Fedora 19)

> > We have a Samba4 KDC

I know very well, hello group-steve :-)

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York




More information about the sssd-devel mailing list