F26 System Wide Change: Kerberos KCM credential cache by default

[Jan Kurik]

= System Wide Change: Kerberos KCM credential cache by default =
https://fedoraproject.org/wiki/Changes/KerberosKCMCache

Change owner(s):
* Jakub Hrozek <jhrozek AT redhat DOT com>


Default to a new Kerberos credential cache type called KCM which is
better suited for containerized environments and provides a better
user experience in the general case as well.


== Detailed Description ==
Over time, Fedora used different credential cache types to store
Kerberos credentials - going from a simple file-based storage (FILE:)
to a directory (DIR:) and most recently a kernel-keyring based cache
(KEYRING:).

Each of these caches has its own set of advantages and disadvantages.
The FILE ccache is very widely supported, but does not allow multiple
primary caches in a collection. The DIR cache does, but creating and
managing the directories including proper access control can be
tricky. The KEYRING cache is not well suited for cases where multiple
semi-isolated environments might share the same kernel. Managing
credential caches' life cycle is not well solved in neither of these
cache types automatically, only with the help of a daemon like SSSD.

The scope of this change is to introduce a new Kerberos credential
cache type called KCM and switch to using it by default.

With KCM, the Kerberos caches are not stored in a "passive" store, but
managed by a daemon. In this setup, the Kerberos library (typically
used through an application, like for example, kinit) is a "KCM
client" and the daemon is being referred to as a "KCM server". The KCM
server will be provided as a socket-activated service of the SSSD
deamon.



== Scope ==
* Proposal owners:
SSSD developers will implement a KCM server. The krb5-libs package
will then switch its default from KEYRING to KCM. The libkrb5 package
will require the sssd-kcm subpackage and enable its socket so that the
KCM server is socket activated when needed. Please note that the KCM
server only listens on a local UNIX socket, not over the network.

* Other developers: None required

* Release engineering: None required

* List of deliverables: None affected

* Policies and guidelines: None required

* Trademark approval: N/A (not needed for this Change)
-- 
Jan Kuřík
Platform & Fedora Program Manager
Red Hat Czech s.r.o., Purkynova 99/71, 612 45 Brno, Czech Republic