[SSSD] How to obtain a renewable ticket from IPA when login to an IPA client?
Simo Sorce
simo at redhat.com
Thu Feb 28 14:48:57 UTC 2013
On Thu, 2013-02-28 at 09:43 -0500, Qing Chang wrote:
> other than using kinit -r afterwards, how can sssd/pam be configured to invoke kinit -r
> at login?
>
> Before migrated to IPA, I install kstart for kerberos clients and run krenew -K 60 to have
> krenew checking every 60 minutes in the background to extend ticket when due to expire.
>
> It does not work with IPA client because it seems IPA client can not obtain a renewable
> ticket by default at login. Can this be changed?
>
> Thanks,
> Qing
>
Look at the sssd-krb5 man page there is a krb5_renewable_lifetime option
in there that should do what you asked for.
Simo.
--
Simo Sorce * Red Hat, Inc * New York
More information about the sssd-devel
mailing list