[SSSD] no krb5 cache produced

Dmitri Pal dpal at redhat.com
Mon Apr 29 17:11:53 UTC 2013


On 04/29/2013 09:30 AM, steve wrote:
> On 04/29/2013 12:55 PM, John Hodrien wrote:
>> On Mon, 29 Apr 2013, Ondrej Kos wrote:
>>
>>> Hi,
>>>
>>> I'm not sure if I understand your situation correctly, but it seems
>>> to me that this could be solvable by creating a symlink pointing
>>> from /tmp/krb5_cc to /var/lib/sss/db/ccache. We just tried it with
>>> Lukas, and it works as i expected.
> Nope, I'm afraid not. The symlink doesn't work. It has to be a real file.
>>
>> Would SELinux throw a spanner in the works?  I've not needed this for
>> cifs, as
>> sec=krb5,multiuser seems to remove the need for the machine credential.
> John, that's not what we find. The whole reason we have this problem
> is that for us, nothing gets mounted unless there's a root cache at
> /tmp multiuser or not. Th only reason we use multiuser is to make cifs
> behave like nfs in that the uid:gid who creates the file is that of
> the user who is logged in and not the guy who mounted the share.
>
> It looks like the cron to keep the ticket alive is the way to go and I
> take your point. Hourly seems fine. The idea is that cifs on the
> client stays alive for as long as the box is booted, not until the
> ticket expires. There's aother utility called k5start which may be
> another solution. It's designed to maintain long running processes.
> I've used it with nslcd.

Have you looked at GSS proxy?
It goal is to provide the separation of duties and automatic ticket
renewal. It is in F19 now.
https://fedoraproject.org/wiki/Features/gss-proxy
This is the direction we are going to solve the problem of the ticket
renewal.

> Cheers,
> Steve
>
>
> I think the ony solution
> _______________________________________________
> sssd-devel mailing list
> sssd-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/sssd-devel


-- 
Thank you,
Dmitri Pal

Sr. Engineering Manager for IdM portfolio
Red Hat Inc.


-------------------------------
Looking to carve out IT costs?
www.redhat.com/carveoutcosts/






More information about the sssd-devel mailing list