[SSSD] no krb5 cache produced

steve steve at steve-ss.com
Sat Apr 27 17:44:51 UTC 2013


On 27/04/13 17:39, Simo Sorce wrote:
> On Sat, 2013-04-27 at 10:46 +0200, steve wrote:
>> On 27/04/13 03:54, Simo Sorce wrote:
>>> On Sat, 2013-04-27 at 00:44 +0200, steve wrote:
>>>> Hi
>>>> 1.9.4 Ubuntu 13.04
>>>>
>>>> We have this in sssd.conf:
>>>>
>>>> ldap_sasl_mech = gssapi
>>>> ldap_sasl_authid = HH16$
>>>> ldap_krb5_keytab = /etc/krb5.keytab
>>>> ldap_krb5_init_creds = true
>>>>
>>>> but no krb5cc_xxxx file appears in /tmp  when we start sssd
>>>>
>>>> This works OK with openSUSE with te same config.
>>>>
>>>> How can we get sssd to produce the cache file as expected?
>>> The ccache file for sssd itself is in /var/lib/sss/db/ccache_<REALM>
>>>
>>> Simo.
>>>
>>> Hi
>>> Thanks, but:
>>> klist -k ccache_HH3.SITE
>>> Keytab name: FILE:ccache_HH3.SITE
> this is ^^not^^ a keytab (-k) it's a ccache.
> Just do klist ccache_HH3.SITE
Yes. I feel so stupid. It's not recognised though.  Other apps expect it 
to be under /tmp and be called krb5cc_0
>
>>> klist: Unsupported key table format version number while starting keytab scan
>>>
>>> So I can't use it for anything else. Is it possible for sssd to produce a cache that klist understands so I can reuse it as the root cache for other processes?
> You may be interested in the gss-proxy project if you need to use keys
> for other components and need a ccache to be generated on the fly for
> you. (works only with MIT kerberos starting on Fedora 19)
Sounds good. We need the cache for automounted cifs from Samba. We need 
the root cache at /tmp/krb5cc_0. As it stands, I have to maintain the 
cache using a cron or by using k5start, which is a pain. I thought that 
as sssd is constantly in play, it could be used to maintain the cache. 
Any idea if I could symlink it from its sssd location to /tmp? BTW, the 
root cache can hold any principal. The MACHINE$ key we use for sss would 
be fine.
>
>>> We have a Samba4 KDC
> I know very well, hello group-steve :-)
>
> Simo.
Yes, of course, that's why the name Simo seems familiar, from the samba 
lists. Samba4 + sssd: Amazing technology.



More information about the sssd-devel mailing list