[35824] in Kerberos
Re: On credential cache separation between service ticket and TGT
daemon@ATHENA.MIT.EDU (Russ Allbery)
Wed Mar 5 14:22:57 2014
From: Russ Allbery <eagle@eyrie.org>
To: Arpit Srivastava <arpit.orb@gmail.com>
In-Reply-To: <CAEvOXU4MDL99atB=ieOw3u+Kvwkg9kKeS7vExV0sqxu9CDUZ7A@mail.gmail.com>
(Arpit Srivastava's message of "Wed, 5 Mar 2014 20:13:12 +0530")
Date: Wed, 05 Mar 2014 11:22:40 -0800
Message-ID: <871tygih6n.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: kerberos <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Arpit Srivastava <arpit.orb@gmail.com> writes:
> I have a centralized service for doing kinit and storing krb5cc at an
> informed path.
If you're doing this from a keytab, note that kinit can obtain credentials
for a particular service principal directly. You don't have to get a TGT;
you can tell it to do an AS-REQ for the specific credentials you want
instead. That way, the TGT never exists in the ticket cache.
--
Russ Allbery (eagle@eyrie.org) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos