[SSSD] no krb5 cache produced

Ondrej Kos okos at redhat.com
Mon Apr 29 10:52:00 UTC 2013


On 04/28/2013 05:31 PM, steve wrote:
> On 04/28/2013 04:12 PM, Simo Sorce wrote:
>> On Sun, 2013-04-28 at 13:31 +0200, steve wrote:
>>> On 04/27/2013 07:54 PM, Lukas Slebodnik wrote:
>>>> On (27/04/13 19:44), steve wrote:
>>>>> On 27/04/13 17:39, Simo Sorce wrote:
>>>>>> On Sat, 2013-04-27 at 10:46 +0200, steve wrote:
>>>>>>> On 27/04/13 03:54, Simo Sorce wrote:
>>>>>>>> On Sat, 2013-04-27 at 00:44 +0200, steve wrote:
>>>>>>>>> Hi
>>>>>>>>> 1.9.4 Ubuntu 13.04
>>>>>>>>>
>>>>>>>>> We have this in sssd.conf:
>>>>>>>>>
>>>>>>>>> ldap_sasl_mech = gssapi
>>>>>>>>> ldap_sasl_authid = HH16$
>>>>>>>>> ldap_krb5_keytab = /etc/krb5.keytab
>>>>>>>>> ldap_krb5_init_creds = true
>>>>>>>>>
>>>>>>>>> but no krb5cc_xxxx file appears in /tmp  when we start sssd
>>>>>>>>>
>>>>>>>>> This works OK with openSUSE with te same config.
>>>>>>>>>
>>>>>>>>> How can we get sssd to produce the cache file as expected?
>>>>>>>> The ccache file for sssd itself is in
>>>>>>>> /var/lib/sss/db/ccache_<REALM>
>>>>>>>>
>>>>>>>> Simo.
>>>>>>>>
>>>>>>>> Hi
>>>>>>>> Thanks, but:
>>>>>>>> klist -k ccache_HH3.SITE
>>>>>>>> Keytab name: FILE:ccache_HH3.SITE
>>>>>> this is ^^not^^ a keytab (-k) it's a ccache.
>>>>>> Just do klist ccache_HH3.SITE
>>>>> Yes. I feel so stupid. It's not recognised though.  Other apps expect
>>>>> it to be under /tmp and be called krb5cc_0
>>>> If you want to store credential caches in /tmp,
>>>> you should override default value of variable krb5_ccachedir.
>>>>
>>>> On fedora 18 default value of krb5_ccachedir is "/run/user/%U"
>>>>
>>>> Look to "man sssd-krb5" for detailed description.
>>>>
>>>> LS
>>>>
>>> Hi
>>> OK, I changed sssd conf to this:
>>>
>>> ldap_sasl_mech = gssapi
>>> ldap_sasl_authid = DOLORESDC$
>>> krb5_ccachedir = /tmp
>>> ldap_krb5_keytab = /etc/krb5.keytab
>>> krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
>>> ldap_krb5_init_creds = true
>> These options are only for user caches.
>> Not for sssd's own machine ccache
>>
>>> I expect to get a cache at:
>>> /tmp/krb5cc_0
>>>
>>> But I don't. Instead, the cache appears at
>>> /var/lib/sss/db/ccache_DOLORES.SITE. I've tried %u instead of %U. Do I
>>> have the correct syntax?
>> The syntax is correct, but will not affect the machine ccache. It's path
>> is hard coded to /var/lib/sss/db/ccache_<REALM>
>>
>> Simo.
>>
> Hi
> OK, so for the machine cache it is hard coded. What about if I change:
>
> ldap_sasl_authid = Administrator
>
> IOW, not the machine key? Do I get a cache under /tmp then?

Hi,

I'm not sure if I understand your situation correctly, but it seems to 
me that this could be solvable by creating a symlink pointing from 
/tmp/krb5_cc to /var/lib/sss/db/ccache. We just tried it with Lukas, and 
it works as i expected.

>
> If not, could you tell me the syntax to have sssd running as root and
> when it starts to have it's cache in /tmp/krb5cc_0 ??
>
> Thanks for your patience.
>
>
> ldap_sasl_authid = DOLORESDC$
>
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Ondrej Kos
Associate Software Engineer
Identity Management
Red Hat Czech



More information about the sssd-devel mailing list