SSSD / sssd

#305 The kerberos provider should automatically kinit users when it goes online
Closed: Fixed Opened by sgallagh.

Closed: Fixed
Reopen Issue

When a user logs in using offline authentication (for example, a user must log in before enabling the vpn), the Kerberos provider should store their credentials in a protected memory area. Once the SSSD detects that the system has gone online, we should kinit on behalf of the users that logged in while offline, so that they will immediately receive a valid TGT.

This ticket complements ticket #304, which will allow a user to identify graphically when they do and do not have a valid kerberos ticket.

Fields changed

cc: => dwalsh, nalin

Fields changed

milestone: SSSD 1.1 => NEEDS_TRIAGE
proposed: => 1.2

Fields changed

milestone: NEEDS_TRIAGE => SSSD 1.1
proposed: 1.2 => 1.1

Fields changed

milestone: SSSD 1.1 => SSSD 1.2
priority: major => minor

Fixed by fc7ec12f1b851bab1eedf3ecdcb094ea80b46dd2

doc: 0 => 1
resolution: => fixed
status: new => closed

Fields changed

fixedin: => 1.2.0

krb5_store_password_if_offline is described in the sssd-krb5 man page. The documentation should explain the 'Automatic kinit when going online' feature and should mention that the cleartext password is saved in the kernel keyring to make it possible. This is a convenience feature and should be used in sensitive environments with care.

Fields changed

rhbz: => 0

Metadata Update from @sgallagh:
- Issue assigned to sbose
- Issue set to the milestone: SSSD 1.2.0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1347

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.
Metadata
None
None
None
High
enhancement
Kerberos Provider
0.99.0
dwalsh, nalin
0
0
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.