Bug 13719 - Kerberos CC KEYRING and net command
Summary: Kerberos CC KEYRING and net command
Status: ASSIGNED
Alias: None
Product: Samba 4.1 and newer
Classification: Unclassified
Component: Tools (show other bugs)
Version: 4.9.3
Hardware: All Linux
: P5 minor (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Samba QA Contact
URL: https://github.com/heimdal/heimdal/is...
Keywords:
Depends on:
Blocks:
 
Reported: 2018-12-18 09:18 UTC by Emmanuel Fournier
Modified: 2019-03-01 19:44 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Emmanuel Fournier 2018-12-18 09:18:05 UTC 
When the kerberos credential cache is set
to the KEYRING ...

Set in the file /etc/krb5.conf with clause :

[libdefaults]
default_ccache_name = KEYRING:persistent:%{uid}

And also in the file /etc/security/pam_winbind.conf with clause :

[global]
krb5_auth = yes
krb5_ccache_type = KEYRING:persistent:UID

Authentication is ok, user receive a TGT
stored in KEYRING CC, but command :

net ads user

ask the password, and after echo :
kerberos_kinit_password SPF-CASTANET@SPF-CASTANET.NET failed: Client not found in Kerberos database
kerberos_kinit_password SPF-CASTANET@SPF-CASTANET.NET failed: Client not found in Kerberos database
kerberos_kinit_password SPF-CASTANET@SPF-CASTANET.NET failed: Client not found in Kerberos database

If we use the FILE CC, everything is OK.
Comment 1 Andrew Bartlett 2018-12-18 17:06:01 UTC 
There is some upstream discussion about this on Heimdal's GitHub: https://github.com/heimdal/heimdal/issues/166

Someone would need to write the code, submit it upstream and then backport it to our Heimdal. 

Or for file-sever only builds, use --with-system-mitkrb5

Sorry,

Andrew Bartlett
Comment 2 Emmanuel Fournier 2018-12-19 10:38:13 UTC 
Ok, great,

I use samba as a AD DC, so i'll continue to use the FILE CC, it's ok.

Can i set this bug resolved ?
Comment 3 Andrew Bartlett 2019-02-04 02:50:10 UTC 
We are working on an upgrade to our Heimdal snapshot, and it seems upstream Heimdal finally has this working.  So there is some hope!
Comment 4 Emmanuel Fournier 2019-02-05 17:51:52 UTC 
Ok, great !