CODEWITHSUNDEEP
linuxkerberospamsssd
g0pher
g0pher

Reputation: 71

struggling with reuse of pam_sss kerberos ticket

Windows admin wrapping my head around PAM/SSSD has been quite tough!

I have managed to to get pam_sss working with

the problem is with reuse of the ticket. i cant work out how it works..

I would like to configure pam_mount and ODBC to use the same ticket.

so

pam_sss creates a ticket with the follwoing naming which cannot be used by the "mount" command:

/tmp/krb5cc_uid_xxxx

however if i manually use kinit, it creates a ticket with the naming below, which can be easily reuse from the "mount" command:

/tmp/krb5cc_uid

the naming that pam_sss uses seems to be standard but again i just cant work out how that should be "discoverable" by any other services looking for a ticket, when it has the wrong naming..

some links..:

this seems to be where the pam_sss naming is defined - by a build flag --with-default-ccname-template

https://github.com/SSSD/sssd/blob/master/src/conf_macros.m4#L337

i want to integrate it into pam_mount to mount a cifs drive, which (i think) is SMB so will be able to use the cifs.upcall library.

And the way cifs.upcall resolves tickets is somehwere here in get_cachename_from_process_env

https://github.com/aaptel/cifs-utils/blob/master/cifs.upcall.c#L260

i also want to get MSSQL ODBC driver to use the ticket as well...

Upvotes: 0

Views: 238

Answers (0)

Related Questions