[SSSD-users] renewal of krb5 tickets created outside SSSD

Michael Gliwinski Michael.Gliwinski at henderson-group.com
Wed Sep 25 12:40:59 UTC 2013

Hi all,

Currently SSSD (when configured with krb5_renew_interval, etc.) will only 
renew tickets it itself created.  Is it possible to somehow tell it to also 
look after some other ccaches?

The use case I have is for sessions started e.g. via sudo -u + manual kinit or 
SSH PKI or SSH GSS-API (i.e. passwordless logins).  Those are sometimes long-
running, but the tickets won't be renewed automatically currently.

If not currently possible, I was thinking of creating some simple program that 
would call SSSD functions to "register" a specified ccache path 
(krb5_save_ccname + add_tgt_to_renew_table?).  Do you see any problems with 
this approach?  Would those functions be somehow accessible from Python API?


The information in this email is confidential and may be legally privileged.  It is intended solely for the addressee and access to the email by anyone else is unauthorised.
If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed  in the governing client engagement leter or contract.
If you have received this email in error please notify support at henderson-group.com

John Henderson (Holdings) Ltd
Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT.
Registered in Northern Ireland
Registration Number NI010588
Vat No.: 814 6399 12

More information about the sssd-users mailing list