2

I log in to Ubuntu 18.04 successfully with kerberos/sssd authentification in an ActiveDirectory domain. Since a few days I have an issue using my kerberos ticket/credentials cache to auth with some server shares.

If i call klist my credentials cache is displayed with start and expire date 01.01.1970. I believe that this causes my issue. After removing /tmp/krb5cc-file and authenticating with kinit again the start and expire date is correct and auth against server shares work like expected.

Do you know about known issues causing this behaviour? Or any hints how to solve this without double authenticate?

Some of my colleagues are working with 18.04 too but without any issues.

Best regards Patrick

pfleckenstein
  • 46

2 Answers2

0

I identified the issue. Seems that something was wrong with my computer account stored in Active Directory. In my case strangely it was missing. Added it with net ads join now everything works like expected. Thanks for your support!

pfleckenstein
  • 46
0

I had a similar issue with my local Single Sign-On environment (not AD but OpenLDAP + MIT Kerberos) after I re-installed Ubuntu 18.04. For me, configuring sssd to automatically renew tickets resolved the issue. I just had to add the following lines to sssd.conf and restart the sssd service.

[domain/MY_REALM_NAME]
...
krb5_lifetime = 7d
krb5_renewable_lifetime = 7d
krb5_renew_interval = 30m
...

https://serverfault.com/a/133631/86462 also has some interesting details about how ticket lifetimes are computed.

cqcallaw
  • 1,123