default_ccache_name ignored/overridden

[dasmouse]

Hello sssd-users list

I'm working on linux workstations in a single-domain Active Directory environment and I'm having a bit of trouble getting Kerberos authenticated SMB printing to work.
In krb5.conf under [libdefaults] I have default_ccache_name = FILE:/tmp/krb5cc_%{uid}. In sssd.conf the krb5_ccname_template key I have left unconfigured.
When I login I read in sssd_MYDOMAIN.log of the workstation:
[sss_check_cc_template]: ccache file name template [FILE:/tmp/krb5cc_%{uid}] doesn't contain randomizing characters (XXXXXX), file might not be rewriteable.
[... and much later ...]
[krb5_mod_ccname]: Save ccname [FILE:/tmp/krb5cc_123456_Fl5FAw] for user [domainuser@mydomain].

From these log entries I take it that for some reason krb5.conf's default_ccache_name template gets overridden. Consequently, instead of a krb5 user cache credential path of FILE:/tmp/krb5cc_123456 that cups could read I get a /tmp/krb5cc_123456_Fl5FAw which cups responds to with file not found and cups requests user authenication. If I cp -p /tmp/krb5cc_123456_Fl5FAw to /tmp/krb5cc_123456 I can print Kerberos authenticated.

In the sssd-krb5 documentation I can't find any hint on why the overriding takes place.

Could you please help me?

Best wishesPhilipp

[Sumit Bose]

Am Thu, Aug 27, 2026 at 07:48:44AM +0000 schrieb dasmouse via sssd-users:
> Hello sssd-users list
>
> I'm working on linux workstations in a single-domain Active Directory environment and I'm having a bit of trouble getting Kerberos authenticated SMB printing to work.
> In krb5.conf under [libdefaults] I have default_ccache_name = FILE:/tmp/krb5cc_%{uid}. In sssd.conf the krb5_ccname_template key I have left unconfigured.
> When I login I read in sssd_MYDOMAIN.log of the workstation:
> [sss_check_cc_template]: ccache file name template [FILE:/tmp/krb5cc_%{uid}] doesn't contain randomizing characters (XXXXXX), file might not be rewriteable.
> [... and much later ...]
> [krb5_mod_ccname]: Save ccname [FILE:/tmp/krb5cc_123456_Fl5FAw] for user [domainuser@mydomain].
>
> From these log entries I take it that for some reason krb5.conf's default_ccache_name template gets overridden. Consequently, instead of a krb5 user cache credential path of FILE:/tmp/krb5cc_123456 that cups could read I get a /tmp/krb5cc_123456_Fl5FAw which cups responds to with file not found and cups requests user authenication. If I cp -p /tmp/krb5cc_123456_Fl5FAw to /tmp/krb5cc_123456 I can print Kerberos authenticated.
>
> In the sssd-krb5 documentation I can't find any hint on why the overriding takes place.
>
> Could you please help me?

Hi,

which version of SSSD are you using?

It might be a left-over from a previous authentication. SSSD keeps the
last ccache file name in its cache. As long as there is a session
running of the given user running when the user logs in again the cached
file name will be used to give the fresh ticket to the other sessions as
well. So you either can try to fully log out, making sure there is no
session for the user still running somewhere in the background or
removed SSSD's cache, e.g. with `sssctl cache-remove ...`. But please
note that removing the cache will remove all stored password hashes so
that offline authentication will only be possible for each user ill only
be possible after a successful online authentication.

If neither of the above helps, please send full SSSD backend and
krb5_child log files covering the authentication.

HTH

bye,
Sumit
> Best wishesPhilipp
> -- 
> _______________________________________________
> sssd-users mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/[e-mail].o...
> Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new