This happens on samba 3.4 and 3.3.2. When logged in through gdm (ubuntu Jaunty) with the pam_winbind module, winbind does happily refresh the kerberos ticket for a while (week? couple days? not sure yet). Then it stops. Restarting winbind causes the ticket to be immediately refreshed. Once stopped it doesn't seem to startup again.

It is strange, when it stops working the ticket left behind always lacks the host SPN:

#klist
Ticket cache: FILE:/tmp/krb5cc_2009
Default principal: jgg@ADS.ORCORP.CA

Valid starting     Expires            Service principal
09/17/09 03:49:49  09/17/09 13:49:49  krbtgt/ADS.ORCORP.CA@ADS.ORCORP.CA
        renew until 09/23/09 15:34:54


Kerberos 4 ticket cache: /tmp/tkt2009
klist: You have no tickets cached
# sudo /etc/init.d/winbind restart
[sudo] password for jgg: 
 * Stopping the Winbind daemon winbind                                                                                 [ OK ] 
 * Starting the Winbind daemon winbind                                                                                 [ OK ] 
jggl{jgg}/scratch/jgg/logic#klist
Ticket cache: FILE:/tmp/krb5cc_2009
Default principal: jgg@ADS.ORCORP.CA

Valid starting     Expires            Service principal
09/17/09 17:19:24  09/18/09 03:19:24  krbtgt/ADS.ORCORP.CA@ADS.ORCORP.CA
        renew until 09/24/09 17:19:24
09/17/09 17:19:24  09/18/09 03:19:24  JGGL$@ADS.ORCORP.CA
        renew until 09/24/09 17:19:24


Kerberos 4 ticket cache: /tmp/tkt2009
klist: You have no tickets cached


I have no idea how to further debug this? Any advice to collect something from some log files?

There is an old bug very similar to this (4945) that recommends the now gone cached_logon setting, but I don't see any log messages that look like what was reported there, the ticket seems to have lots of renewable lifetime left, and winbind can clearly re-get the ticket on its own after being restarted.. Time sync to the AD server looks good.

Thanks,
Jason