[22744] in Kerberos
Renewable Tickets
daemon@ATHENA.MIT.EDU (Phil Dibowitz)
Mon Oct 25 15:05:48 2004
Date: Mon, 25 Oct 2004 12:02:20 -0700
From: Phil Dibowitz <phil@usc.edu>
To: kerberos@mit.edu
Message-ID: <20041025190220.GO26380@usc.edu>
Mime-Version: 1.0
Content-Type: multipart/mixed; boundary="===============45383764187986042=="
Errors-To: kerberos-bounces@mit.edu
--===============45383764187986042==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="LqIGKb6ivCeGIB65"
Content-Disposition: inline
--LqIGKb6ivCeGIB65
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
So I have a kerberos realm. The KDC allows renewable tickets, but I
can't get a ticket with a renewable time longer than 0 seconds.
My kdc.conf has (among other things):
max_life =3D 10h 0m 0s
max_renewable_life =3D 7d 0h 0m 0s
default_principal_flags =3D +forwardable,+renewable
My krb5.conf originally had:
[appdefaults]
kinit =3D {
renewable =3D true
forwardable =3D true
}
as well as:
[libdefaults]
ticket_lifetime =3D 600
default_realm =3D ISD.USC.EDU
...
But according to the man page, you can put a "renew_lifetime" in the
libdefaults section which defaults to 0 -- bingo! right? So I changed
the libdefaults section to:
[libdefaults]
ticket_lifetime =3D 600
renew_lifetime =3D 700
default_realm =3D ISD.USC.EDU
...
But that broke things:
[phil@frantic phil]$ kinit
kinit(v5): Invalid argument while getting initial credentials
I tried various other values for renew_lifetime: 1, 4, 300, 400, 1200. I al=
so
tried taking these completely out and using "kinit -r 10d" which gives me a
renewable lifetime of 0 seconds as well.
If I put renew_lifetime in the appdefaults section, it appears to get
ignored. I also tried taking the "kinit =3D {" part out and having
appdefaults be global, but that didn't work either.
It is noteworthy that a "kinit -r 7:0:0" (or even a "kinit -r 30:00")=20
still gets a renewal time of 0, despite it being a "renewable"
ticket:
Valid starting Expires Service principal
07/20/04 14:02:36 07/21/04 00:02:36 krbtgt/ISD.USC.EDU@ISD.USC.EDU
renew until 07/20/04 14:02:36, Flags: RI
Which leads me to believe its a kdc.conf problem not a krb5.conf
problem. However max_renewable_life is the only config I can find in
the man page that is applicable.
It's an MIT Kerberos V KDC (1.3.1) on Solaris 8 with Solaris 8 and 9 clients
(also using MIT kerb).
Thoughts, suggestions, or comments appreciated.
--=20
Phil Dibowitz
Systems Architect and Administrator
Enterprise Infrastructure / ISD / USC
UCC 174 - 213-821-5427
--LqIGKb6ivCeGIB65
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFBfU287lkZ1Iyv898RAi1/AKCewJCgx0ldEQyJn3XlUCTRE/qPNgCgvpce
BCR6PnUrGn2QeUjVKGTKauw=
=/t2k
-----END PGP SIGNATURE-----
--LqIGKb6ivCeGIB65--
--===============45383764187986042==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============45383764187986042==--
