[SSSD] no krb5 cache produced

Lukas Slebodnik lslebodn at redhat.com
Sat Apr 27 17:54:51 UTC 2013


On (27/04/13 19:44), steve wrote:
>On 27/04/13 17:39, Simo Sorce wrote:
>>On Sat, 2013-04-27 at 10:46 +0200, steve wrote:
>>>On 27/04/13 03:54, Simo Sorce wrote:
>>>>On Sat, 2013-04-27 at 00:44 +0200, steve wrote:
>>>>>Hi
>>>>>1.9.4 Ubuntu 13.04
>>>>>
>>>>>We have this in sssd.conf:
>>>>>
>>>>>ldap_sasl_mech = gssapi
>>>>>ldap_sasl_authid = HH16$
>>>>>ldap_krb5_keytab = /etc/krb5.keytab
>>>>>ldap_krb5_init_creds = true
>>>>>
>>>>>but no krb5cc_xxxx file appears in /tmp  when we start sssd
>>>>>
>>>>>This works OK with openSUSE with te same config.
>>>>>
>>>>>How can we get sssd to produce the cache file as expected?
>>>>The ccache file for sssd itself is in /var/lib/sss/db/ccache_<REALM>
>>>>
>>>>Simo.
>>>>
>>>>Hi
>>>>Thanks, but:
>>>>klist -k ccache_HH3.SITE
>>>>Keytab name: FILE:ccache_HH3.SITE
>>this is ^^not^^ a keytab (-k) it's a ccache.
>>Just do klist ccache_HH3.SITE
>Yes. I feel so stupid. It's not recognised though.  Other apps expect
>it to be under /tmp and be called krb5cc_0

If you want to store credential caches in /tmp,
you should override default value of variable krb5_ccachedir.

On fedora 18 default value of krb5_ccachedir is "/run/user/%U"

Look to "man sssd-krb5" for detailed description.

LS

>>
>>>>klist: Unsupported key table format version number while starting keytab scan
>>>>
>>>>So I can't use it for anything else. Is it possible for sssd to produce a cache that klist understands so I can reuse it as the root cache for other processes?
>>You may be interested in the gss-proxy project if you need to use keys
>>for other components and need a ccache to be generated on the fly for
>>you. (works only with MIT kerberos starting on Fedora 19)
>Sounds good. We need the cache for automounted cifs from Samba. We
>need the root cache at /tmp/krb5cc_0. As it stands, I have to
>maintain the cache using a cron or by using k5start, which is a pain.
>I thought that as sssd is constantly in play, it could be used to
>maintain the cache. Any idea if I could symlink it from its sssd
>location to /tmp? BTW, the root cache can hold any principal. The
>MACHINE$ key we use for sss would be fine.
>>
>>>>We have a Samba4 KDC
>>I know very well, hello group-steve :-)
>>
>>Simo.
>Yes, of course, that's why the name Simo seems familiar, from the
>samba lists. Samba4 + sssd: Amazing technology.



More information about the sssd-devel mailing list