/etc/krb5.conf is the wrong place for such an option. We do not generally use /etc/krb5.conf for anything (our locator plugin handles this, so it's possible to operate without an /etc/krb5.conf at all)

We will add an option to the kerberos provider, {{{krb5_ticket_lifetime}}} which should default to 24 hours (limited by the server's maximum lifetime).

milestone: NEEDS_TRIAGE => SSSD 1.2.1

Fields changed

owner: somebody => sgallagh

Fields changed

component: SSSD => LDAP Provider

This option is not an option for kerberos provider.

This is an option for LDAP provider. It affects lifetime for the ticket acquired, when SSSD LDAP backend itself authenticates using host/FQDN SPN (stashed in /etc/krb5.keytab) with LDAP service.

You are correct. This option would be more properly {{{ldap_krb5_ticket_lifetime}}}

Fields changed

milestone: SSSD 1.2.1 => SSSD 1.2.0

Fields changed

owner: sgallagh => sbose

Fixed by bc45212faf209b10d2d6eb57e056a5e6f04b0876

doc: 0 => 1
fixedin: => 1.2.0
resolution: => fixed
status: new => closed
tests: 0 => 1

ldap_krb5_ticket_lifetime is described in the man page. Documentation should mention that the repeated occurrence of GSSAPI error messages in the system log with a similar interval as ldap_krb5_ticket_lifetime does not indicate an error. If the ticket has reached the end of its lifetime chances are that it is used in an attempt to connect to an LDAP server which will result in the GSSAPI error. A new ticket will be automatically requested.

Newer version of sssd (>= 1.3.0) actively trying to avoid this error message.

Fields changed

rhbz: => 0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1509

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.