[SSSD-users] renewal of krb5 tickets created outside SSSD

Michael Gliwinski Michael.Gliwinski at henderson-group.com
Thu Sep 26 11:30:22 UTC 2013


On Thursday 26 Sep 2013 12:05:05 Jakub Hrozek wrote:
> On Thu, Sep 26, 2013 at 10:23:54AM +0100, Michael Gliwinski wrote:
> > On Wednesday 25 Sep 2013 13:59:31 Dmitri Pal wrote:
> > > On 09/25/2013 09:41 AM, Stephen Gallagher wrote:
> > > > On 09/25/2013 08:40 AM, Michael Gliwinski wrote:
> > > > > Currently SSSD (when configured with krb5_renew_interval,
> > > > > etc.)
> > > > > will only renew tickets it itself created.  Is it possible
> > > > > to
> > > > > somehow tell it to also look after some other ccaches?
...
> > These aren't automated logins, for those I already use a keytab as you
> > said and k5start to init/renew tickets automatically.
> > 
> > It's some of our users/admins/dbas, etc who log on to servers and run
> > jobs that may take e.g. 2 days.
> 
> Would it help your use case to request renewable tickets and then use
> SSSD's renewing as per krb5_renew_interval and krb5_renewable_lifetime ?

That is already what I do.  However SSSD will not watch after tickets it 
hasn't initialised itself - e.g. ones obtained via manual kinit, or forwarded 
via ssh -K.  That's why I was looking for a way to "tell" SSSD "hey, here's a 
ccache /tmp/krb5cc_11111, look after it" :)


**********************************************************************************************
The information in this email is confidential and may be legally privileged.  It is intended solely for the addressee and access to the email by anyone else is unauthorised.
If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful.
When addressed to our clients, any opinions or advice contained in this e-mail are subject to the terms and conditions expressed  in the governing client engagement leter or contract.
If you have received this email in error please notify support at henderson-group.com

John Henderson (Holdings) Ltd
Registered office: 9 Hightown Avenue, Mallusk, County Antrim, Northern Ireland, BT36 4RT.
Registered in Northern Ireland
Registration Number NI010588
Vat No.: 814 6399 12
*********************************************************************************



More information about the sssd-users mailing list