Hello,
had anybody successfully configured kcm cache in sssd? If yes, what is the correct way? I found some partial resources which did not lead me to a working solution.
I use Fedora 43. I have configured:
/etc/krb5.conf.d/kcm_default_ccache
[libdefaults]
default_ccache_name = KCM:
This configuration is still using files.
I configured /etc/sssd/sssd.conf:
krb5_ccname_template = KCM:%U
and commented out:
#krb5_ccachedir = /tmp
#krb5_ccname_template = FILE:%d/krb5cc_%U_XXXXXX
But files still have been used. I found out the variable KRB5CCNAME still contains FILE:/tmp/krb5cc_..... with the original template.
I found in some forums workaround by setting the filter in /etc/sssd/sssd.conf
[pam]
pam_response_filter = ENV:KRB5CCNAME
This started partially working.
When I logged in with user with UID 1000000 and run klist, I have seen all the tickets in KCM:1000000, but the file in /tmp still have been created, which looked weird for me.
Then I used AI to help me with this, since I was not able to find any more resources. She told me to alter /etc/sssd/sssd.conf:
[sssd]
services = nss, pam
change to:
[sssd]
services = nss, pam, kcm
This lead to failure to start the sssd, so I reverted the last change and rebooted and I was thinking I have a partially working setup and planned to leave it like this for a while. But unfortunately after the reboot user with UID 1000001 came and logged in. Nothing was working for him. When I asked him to run klist, tickets were not there and there was some error message about KCM:1000001. I do not remember for sure, but I think it was KCM:1000001 not found. I had to revert all the changes immediately to the original state with using files.
Can anybody help me to firstly analyze what happened and why it was working for user 1000000 and not for user 1000001 (I do not know whether the test the AI told me to do started the problem for all the users) and secondly how to configure it right way to use KCM instead of files without the workaround with the pam filter for KRB5CCNAME environment variable?
Thanks
Marek